byteplus-python-sdk-v2 3.0.61__py2.py3-none-any.whl → 3.0.63__py2.py3-none-any.whl

byteplussdkcore/api_client.py

@@ -2,8 +2,10 @@
 
 from __future__ import absolute_import
 
+import copy
 import datetime
 import logging
+import threading
 import time
 from multiprocessing.pool import ThreadPool
 from time import sleep
@@ -59,6 +61,8 @@ class ApiClient(object):
         if configuration is None:
             configuration = Configuration()
         self.configuration = configuration
+        self._credential_binding_lock = threading.Lock()
+        self.rebind_credential_provider()
         # Use the pool property to lazily initialize the ThreadPool.
         self._pool = None
         self._base_auto_retry = configuration.auto_retry
@@ -69,7 +73,7 @@ class ApiClient(object):
             self.default_headers[header_name] = header_value
         self.cookie = cookie
         # Set default User-Agent.
-        self.user_agent = 'byteplus-python-sdk-v2/3.0.61'
+        self.user_agent = 'byteplus-python-sdk-v2/3.0.63'
         self.client_side_validation = configuration.client_side_validation
 
         self.interceptor_chain = InterceptorChain()
@@ -106,6 +110,24 @@ class ApiClient(object):
     def set_default_header(self, header_name, header_value):
         self.default_headers[header_name] = header_value
 
+    def rebind_credential_provider(self):
+        """Snapshot the current provider/proxy configuration with a fresh STS cache.
+
+        Call after changing configuration or provider settings. Existing requests
+        retain their binding; concurrent mutation of the source is unsupported.
+        Custom providers retain their identity and no-argument retrieval API.
+        """
+        from byteplussdkcore.auth.provider_binding import bind_credential_provider
+        with self._credential_binding_lock:
+            self._credential_provider = bind_credential_provider(
+                self.configuration.credential_provider, self.configuration)
+
+    def _create_request(self, *args, **kwargs):
+        provider = self._credential_provider
+        request = Request(self.configuration, *args, **kwargs)
+        request.credential_provider = provider
+        return request
+
     def __call_api(
             self, resource_path, method, path_params=None,
             query_params=None, header_params=None, body=None, post_params=None,
@@ -119,8 +141,7 @@ class ApiClient(object):
         if self.cookie:
             header_params['Cookie'] = self.cookie
 
-        request = Request(
-            self.configuration,
+        request = self._create_request(
             resource_path, method, path_params,
             query_params, header_params, body, post_params,
             files, response_type, auth_settings,
@@ -414,7 +435,8 @@ class ApiClient(object):
                   host=None, scheme='https', region='cn-beijing',
                   timeout=30, service='sts',
                   max_retries=3, retry_interval=1,
-                  provider_name="ApiClient"):
+                  provider_name="ApiClient",
+                  proxy_url=None, ca_file=None, insecure_skip_verify=False):
         """Invoke an STS federation endpoint (AssumeRoleWithOIDC / AssumeRoleWithSAML / etc.)
         through the SDK's main REST stack while explicitly disabling signing.
 
@@ -444,10 +466,8 @@ class ApiClient(object):
         Returns the unwrapped `Result` dict from the STS response. Business
         errors bubble up as `rest.ApiException` (matching master behavior).
         """
-        # Configuration() via the TypeWithDefault metaclass returns a shallow
-        # copy of the user's default configuration, so TLS/proxy/timeout
-        # settings propagate to the STS call.
-        fresh = Configuration()
+        # Preserve the initiating provider's bind-time transport snapshot.
+        fresh = copy.copy(self.configuration)
         # Break recursion on three fronts:
         #   1. credential_provider=None so SignRequestInterceptor won't call
         #      back into the provider via get_credentials().
@@ -472,6 +492,7 @@ class ApiClient(object):
         # Caller semantics: max_retries = TOTAL attempts (legacy from
         # _do_http_request's for-loop). Configuration semantics:
         # num_max_retries = retries AFTER the initial attempt. Convert.
+        fresh.auto_retry = True
         fresh.num_max_retries = max(max_retries - 1, 0)
         # retry_interval is seconds; Configuration uses ms.
         # Collapse the exponential-backoff range to a fixed delay.
@@ -480,6 +501,13 @@ class ApiClient(object):
         fresh.min_retry_delay_ms = delay_ms
         fresh.max_retry_delay_ms = delay_ms
 
+        # Proxy / TLS customization for reaching the STS endpoint. Only applied
+        # when the caller opted in (any of the three set); otherwise the fresh
+        # Configuration keeps its inherited proxy/TLS settings (including
+        # HTTP_PROXY / HTTPS_PROXY env-var fallback in RESTClientObject).
+        from byteplussdkcore.auth.sts_http_config import StsHttpConfig
+        StsHttpConfig(proxy_url, ca_file, insecure_skip_verify).apply_to_configuration(fresh)
+
         # NOTE: NEW ApiClient(fresh), not self -- avoids re-entering caller's provider chain.
         client = ApiClient(fresh)
         # BuildRequestInterceptor parses resource_path by index:

byteplussdkcore/auth/provider_binding.py

@@ -0,0 +1,42 @@
+"""Client-local bindings for the concrete built-in STS providers."""
+import copy
+import threading
+
+from six.moves.urllib.parse import urlparse
+
+
+def new_sts_configuration(provider):
+    from byteplussdkcore.configuration import Configuration
+
+    snapshot = getattr(provider, '_sts_base_configuration', None)
+    configuration = copy.copy(snapshot) if snapshot is not None else Configuration()
+    configuration.credential_provider = None
+    return configuration
+
+
+def bind_credential_provider(provider, configuration):
+    from .providers.sts_provider import StsCredentialProvider
+    from .providers.sts_oidc_provider import StsOidcCredentialProvider
+    from .providers.sts_saml_provider import StsSamlCredentialProvider
+
+    # Unknown subclasses can own resources or custom copy behavior.
+    if type(provider) not in (
+            StsCredentialProvider, StsOidcCredentialProvider, StsSamlCredentialProvider):
+        return provider
+
+    with provider._lock:
+        bound = copy.copy(provider)
+        bound.policy = copy.deepcopy(provider.policy)
+        bound.credentials = None
+        bound.expired_time = None
+        bound._lock = threading.Lock()
+        bound._sts_base_configuration = new_sts_configuration(provider)
+        # Endpoint resolution accepts a scheme embedded in host.
+        scheme = urlparse(bound.host).scheme if bound.host and '://' in bound.host else bound.scheme
+        bound.scheme = scheme
+        fallback = configuration.proxy
+        if not fallback and scheme in ('http', 'https'):
+            fallback = getattr(configuration, scheme + '_proxy')
+        # Do not turn environment proxy settings into explicit overrides.
+        bound._proxy_fallback = fallback or None
+    return bound

byteplussdkcore/auth/providers/sts_oidc_provider.py

@@ -27,7 +27,8 @@ class StsOidcCredentialProvider(Provider):
                  host='sts.ap-southeast-1.byteplusapi.com', region='ap-southeast-1', timeout=30,
                  expired_buffer_seconds=60, policy=None,
                  role_trn=None, oidc_token_file=None, session_name=None,
-                 max_retries=3, retry_interval=1):
+                 max_retries=3, retry_interval=1,
+                 proxy_url=None, ca_file=None, insecure_skip_verify=False):
 
         self._legacy_mode = oidc_token is not None
 
@@ -78,6 +79,13 @@ class StsOidcCredentialProvider(Provider):
         self.region = region
         self.scheme = scheme
 
+        # Proxy / TLS customization for reaching the STS endpoint. All optional;
+        # empty by default so RESTClientObject keeps its normal behavior
+        # (including HTTP_PROXY / HTTPS_PROXY env-var fallback).
+        self.proxy_url = proxy_url or None
+        self.ca_file = ca_file or None
+        self.insecure_skip_verify = bool(insecure_skip_verify)
+
         if expired_buffer_seconds > 600:
             raise ValueError('expired_buffer_seconds must be less than or equal to 600')
         self.expired_buffer_seconds = expired_buffer_seconds
@@ -157,8 +165,17 @@ class StsOidcCredentialProvider(Provider):
 
         # Late imports to avoid circular deps (auth.providers is imported
         # indirectly by byteplussdkcore/__init__.py).
-        from byteplussdkcore import ApiClient, Configuration
-        resp_result = ApiClient(Configuration())._sts_call(
+        from byteplussdkcore import ApiClient
+        from byteplussdkcore.auth.provider_binding import new_sts_configuration
+        from byteplussdkcore.auth.sts_http_config import StsHttpConfig
+        configuration = new_sts_configuration(self)
+        configuration.scheme = self.scheme
+        # Apply overrides before ApiClient constructs its REST transport.
+        StsHttpConfig(
+            self.proxy_url or getattr(self, '_proxy_fallback', None),
+            self.ca_file, self.insecure_skip_verify
+        ).apply_to_configuration(configuration)
+        resp_result = ApiClient(configuration)._sts_call(
             action='AssumeRoleWithOIDC',
             version='2018-01-01',
             params=params,
@@ -169,6 +186,9 @@ class StsOidcCredentialProvider(Provider):
             max_retries=self.max_retries,
             retry_interval=self.retry_interval,
             provider_name=self.PROVIDER_NAME,
+            proxy_url=self.proxy_url or getattr(self, '_proxy_fallback', None),
+            ca_file=self.ca_file,
+            insecure_skip_verify=self.insecure_skip_verify,
         )
         if 'Credentials' not in resp_result:
             raise RuntimeError(

byteplussdkcore/auth/providers/sts_provider.py

@@ -5,7 +5,7 @@ from datetime import datetime
 
 import dateutil.parser
 
-from byteplussdkcore import UniversalApi, UniversalInfo, ApiClient, Configuration
+from byteplussdkcore import UniversalApi, UniversalInfo, ApiClient
 from .provider import Provider, CredentialValue
 
 
@@ -20,7 +20,8 @@ class AssumeRoleCredentials:
 
 class StsCredentialProvider(Provider):
     def __init__(self, ak, sk, role_name, account_id, duration_seconds=3600, scheme='https',
-                 host='sts.ap-southeast-1.byteplusapi.com', region='ap-southeast-1', timeout=30, expired_buffer_seconds=60, policy=None, max_retries=3, retry_interval=1):
+                 host='sts.ap-southeast-1.byteplusapi.com', region='ap-southeast-1', timeout=30, expired_buffer_seconds=60, policy=None, max_retries=3, retry_interval=1,
+                 proxy_url=None, ca_file=None, insecure_skip_verify=False):
         self.ak = ak
         self.sk = sk
         self.role_name = role_name
@@ -36,6 +37,13 @@ class StsCredentialProvider(Provider):
         self.scheme = scheme
         self.policy = policy
 
+        # Proxy / TLS customization for reaching the STS endpoint. All optional;
+        # empty by default so RESTClientObject keeps its normal behavior
+        # (including HTTP_PROXY / HTTPS_PROXY env-var fallback).
+        self.proxy_url = proxy_url or None
+        self.ca_file = ca_file or None
+        self.insecure_skip_verify = bool(insecure_skip_verify)
+
         self.expired_time = None
         if expired_buffer_seconds > 600:
             raise ValueError('expired_buffer_seconds must be less than or equal to 600')
@@ -69,18 +77,39 @@ class StsCredentialProvider(Provider):
         }
         if self.policy is not None:
             params['Policy'] = self.policy
-        configuration = type.__call__(Configuration)
+        # Bound clients retain the default STS transport settings from binding.
+        # Direct provider use still inherits the current default configuration.
+        from byteplussdkcore.auth.provider_binding import new_sts_configuration
+        configuration = new_sts_configuration(self)
+        # Break recursion: this AssumeRole call signs with the explicit ak/sk
+        # below, so it must NOT re-enter a credential provider (which could be
+        # this very provider via the inherited default configuration).
+        configuration.credential_provider = None
         configuration.ak = self.ak
         configuration.sk = self.sk
+        configuration.session_token = ""
         configuration.host = self.host
         configuration.region = self.region
         configuration.scheme = self.scheme
         configuration.read_timeout = self.timeout
 
+        # Provider max_retries controls total attempts independently of business retry.
+        configuration.auto_retry = True
         configuration.num_max_retries = max(self.max_retries - 1, 0)
         delay_ms = int(self.retry_interval * 1000)
         configuration.min_retry_delay_ms = delay_ms
         configuration.max_retry_delay_ms = delay_ms
+
+        # Proxy / TLS customization for reaching the STS endpoint. Only applied
+        # when the caller opted in; otherwise the configuration keeps its
+        # default proxy/TLS settings (including HTTP_PROXY / HTTPS_PROXY
+        # env-var fallback in RESTClientObject).
+        from byteplussdkcore.auth.sts_http_config import StsHttpConfig
+        StsHttpConfig(
+            self.proxy_url or getattr(self, '_proxy_fallback', None),
+            self.ca_file, self.insecure_skip_verify
+        ).apply_to_configuration(configuration)
+
         c = UniversalApi(ApiClient(configuration))
         info = UniversalInfo(method='GET', service='sts', version='2018-01-01', action='AssumeRole',
                              content_type='text/plain')

byteplussdkcore/auth/providers/sts_saml_provider.py

@@ -24,7 +24,8 @@ class StsSamlCredentialProvider(Provider):
     def __init__(self, role_name=None, account_id=None, provider_name=None, saml_resp=None,
                  duration_seconds=3600, scheme='https',
                  host='sts.ap-southeast-1.byteplusapi.com', region='ap-southeast-1', timeout=30, expired_buffer_seconds=60,
-                 policy=None, role_trn=None, saml_provider_trn=None, max_retries=3, retry_interval=1):
+                 policy=None, role_trn=None, saml_provider_trn=None, max_retries=3, retry_interval=1,
+                 proxy_url=None, ca_file=None, insecure_skip_verify=False):
         self.role_name = role_name
         self.account_id = account_id
         self.provider_name = provider_name
@@ -58,6 +59,13 @@ class StsSamlCredentialProvider(Provider):
         self.scheme = scheme
         self.policy = policy
 
+        # Proxy / TLS customization for reaching the STS endpoint. All optional;
+        # empty by default so RESTClientObject keeps its normal behavior
+        # (including HTTP_PROXY / HTTPS_PROXY env-var fallback).
+        self.proxy_url = proxy_url or None
+        self.ca_file = ca_file or None
+        self.insecure_skip_verify = bool(insecure_skip_verify)
+
         self.expired_time = None
         if expired_buffer_seconds > 600:
             raise ValueError('expired_buffer_seconds must be less than or equal to 600')
@@ -117,8 +125,17 @@ class StsSamlCredentialProvider(Provider):
         }
         if self.policy is not None:
             params['Policy'] = self.policy
-        from byteplussdkcore import ApiClient, Configuration
-        resp_result = ApiClient(Configuration())._sts_call(
+        from byteplussdkcore import ApiClient
+        from byteplussdkcore.auth.provider_binding import new_sts_configuration
+        from byteplussdkcore.auth.sts_http_config import StsHttpConfig
+        configuration = new_sts_configuration(self)
+        configuration.scheme = self.scheme
+        # Apply overrides before ApiClient constructs its REST transport.
+        StsHttpConfig(
+            self.proxy_url or getattr(self, '_proxy_fallback', None),
+            self.ca_file, self.insecure_skip_verify
+        ).apply_to_configuration(configuration)
+        resp_result = ApiClient(configuration)._sts_call(
             action='AssumeRoleWithSAML',
             version='2018-01-01',
             params=params,
@@ -129,6 +146,9 @@ class StsSamlCredentialProvider(Provider):
             max_retries=self.max_retries,
             retry_interval=self.retry_interval,
             provider_name=self.PROVIDER_NAME,
+            proxy_url=self.proxy_url or getattr(self, '_proxy_fallback', None),
+            ca_file=self.ca_file,
+            insecure_skip_verify=self.insecure_skip_verify,
         )
         if 'Credentials' not in resp_result:
             raise RuntimeError(

byteplussdkcore/auth/sts_http_config.py

@@ -0,0 +1,133 @@
+# coding: utf-8
+"""Proxy / TLS customization shared by the STS credential providers.
+
+This mirrors the Go SDK's ``ProxyConfig`` (see ``byteplus/credentials/
+http_client.go``). It bundles the three public knobs used when reaching the
+STS endpoint and knows how to project them onto an SDK ``Configuration``:
+
+    proxy_url            -> configuration.proxy
+    ca_file              -> configuration.ssl_ca_cert
+    insecure_skip_verify -> configuration.verify_ssl (inverted)
+
+Unlike the Go SDK -- which builds a dedicated ``*http.Transport`` -- the
+Python SDK already routes every request (including STS federation calls)
+through ``RESTClientObject``, which reads these ``Configuration`` fields
+directly. So the only thing this helper needs to do is set the fields.
+
+An explicit provider ``proxy_url`` wins over its client-local fallback.
+When both are empty, the transport retains default configuration and
+``HTTP_PROXY`` / ``HTTPS_PROXY`` lookup; it does not implement ``NO_PROXY``.
+
+TLS priority also matches Go's ``tls.Config``: ``insecure_skip_verify``
+takes precedence over ``ca_file`` (when verification is skipped the custom
+CA is irrelevant).
+"""
+
+from __future__ import absolute_import
+
+import base64
+
+import six
+from six.moves.urllib.parse import unquote, urlparse
+
+
+class StsHttpConfig(object):
+    """Carries proxy / TLS options for a single STS request path.
+
+    :param proxy_url: Forward proxy address, ``scheme://[user:password@]host:port``.
+                      Empty preserves default configuration and environment lookup.
+    :param ca_file: Path to a custom CA bundle (PEM) used to verify the STS
+                    server certificate. Restores verification unless skipped.
+                    Empty inherits ssl_ca_cert, otherwise REST uses certifi.
+    :param insecure_skip_verify: When True, skip TLS certificate/hostname
+                    verification. For debugging only; never use in production.
+    """
+
+    def __init__(self, proxy_url=None, ca_file=None, insecure_skip_verify=False):
+        self.proxy_url = proxy_url or None
+        self.ca_file = ca_file or None
+        self.insecure_skip_verify = bool(insecure_skip_verify)
+
+    def is_empty(self):
+        """True when no proxy/TLS option is configured.
+
+        Callers use this to leave the underlying ``Configuration`` untouched,
+        so existing behavior (including BYTEPLUS env-var proxies) is
+        preserved when the user did not opt in. Mirrors Go's ``IsZero``.
+        """
+        return (not self.proxy_url) and (not self.ca_file) and (not self.insecure_skip_verify)
+
+    def apply_to_configuration(self, configuration):
+        """Project the configured options onto ``configuration`` in place.
+
+        No-op when :meth:`is_empty` is True.
+        """
+        if self.is_empty():
+            return configuration
+
+        if self.proxy_url:
+            # Highest-priority proxy source; RESTClientObject honors this over
+            # http_proxy / https_proxy / env vars.
+            configuration.proxy = self.proxy_url
+
+        # TLS: insecure_skip_verify wins over ca_file (same as Go's tls.Config,
+        # where RootCAs is ignored once InsecureSkipVerify is set).
+        if self.insecure_skip_verify:
+            configuration.verify_ssl = False
+            configuration.ssl_ca_cert = None
+        elif self.ca_file:
+            configuration.verify_ssl = True
+            configuration.ssl_ca_cert = self.ca_file
+
+        return configuration
+
+    def proxy_authorization_header(self):
+        """Return the ``Proxy-Authorization`` header value, or None.
+
+        Delegates to :func:`build_proxy_authorization_header` using this
+        config's ``proxy_url``.
+        """
+        return build_proxy_authorization_header(self.proxy_url)
+
+
+def build_proxy_authorization_header(proxy_url):
+    """Build a ``Basic`` ``Proxy-Authorization`` value from an embedded userinfo.
+
+    urllib3 (v2) does NOT automatically forward the ``user:password@`` embedded
+    in a proxy URL as a ``Proxy-Authorization`` header, whereas Go's
+    ``http.ProxyURL`` / ``http.ProxyFromEnvironment`` do. To keep behavior
+    aligned with the Go SDK, callers extract this header explicitly and pass it
+    to ``ProxyManager(proxy_headers=...)``.
+
+    Returns None when ``proxy_url`` is empty or carries no userinfo. Raises
+    ``ValueError`` when ``proxy_url`` cannot be parsed.
+    """
+    if not proxy_url:
+        return None
+
+    try:
+        parsed = urlparse(proxy_url)
+    except (ValueError, AttributeError) as e:
+        raise ValueError("invalid proxy url {0!r}: {1}".format(proxy_url, e))
+
+    username = parsed.username
+    if username is None:
+        return None
+    password = parsed.password or ""
+
+    # Go's http.Transport derives proxy Basic auth from url.Userinfo, whose
+    # Username()/Password() return the PERCENT-DECODED values. urlparse keeps
+    # userinfo raw, so decode here to stay byte-for-byte identical with the Go
+    # SDK (e.g. a "p%40ss" password must be sent as "p@ss").
+    # Python 2 unquote accepts UTF-8 bytes; Python 3 accepts text.
+    if six.PY2:
+        username = username.encode("utf-8") if isinstance(username, six.text_type) else username
+        password = password.encode("utf-8") if isinstance(password, six.text_type) else password
+    username = unquote(username)
+    password = unquote(password)
+    if isinstance(username, six.text_type):
+        username = username.encode("utf-8")
+    if isinstance(password, six.text_type):
+        password = password.encode("utf-8")
+    # urllib3.make_headers uses Latin-1, which cannot encode UTF-8 userinfo.
+    return "Basic " + base64.b64encode(username + b":" + password).decode("ascii")

byteplussdkcore/configuration.py

@@ -302,7 +302,7 @@ class Configuration(six.with_metaclass(TypeWithDefault, object)):
                "OS: {env}\n" \
                "Python Version: {pyversion}\n" \
                "Version of the API: 0.1.0\n" \
-               "SDK Package Version: 3.0.61".\
+               "SDK Package Version: 3.0.63".\
             format(env=sys.platform, pyversion=sys.version)
 
     @property

byteplussdkcore/feature/rds/connect_utils.py

@@ -6,9 +6,8 @@ This module provides utilities for generating authentication tokens for RDS MySQ
 """
 
 from byteplussdkcore.endpoint.providers.standard_provider import StandardEndpointResolver
-from byteplussdkcore.interceptor import InterceptorChain, InterceptorContext, SignRequestInterceptor, \
+from byteplussdkcore.interceptor import InterceptorChain, InterceptorContext, \
     ResolveEndpointInterceptor
-from byteplussdkcore.interceptor import Request
 
 DEFAULT_SERVICE = 'rds_mysql'
 DEFAULT_API_VERSION = '2022-01-01'
@@ -58,11 +57,10 @@ def build_auth_token(api_client, db_user, instance_id, expires=None):
     }
 
     # Create Request with presign mode
-    request = Request(configuration,
-                      resource_path='/{}/{}/{}/get/text_plain/'.format(DEFAULT_API, DEFAULT_API_VERSION,
-                                                                       DEFAULT_SERVICE),
-                      method='GET',
-                      query_params=query)
+    request = api_client._create_request(
+        resource_path='/{}/{}/{}/get/text_plain/'.format(
+            DEFAULT_API, DEFAULT_API_VERSION, DEFAULT_SERVICE),
+        method='GET', query_params=query)
     request.endpoint_provider = StandardEndpointResolver()
     request.service = DEFAULT_SERVICE
     request.is_presign = True
@@ -82,7 +80,7 @@ def build_auth_token(api_client, db_user, instance_id, expires=None):
 
     # Step 3: Sign request (host is None, won't be included in signature)
     sign_chain = InterceptorChain()
-    sign_chain.append_request_interceptor(SignRequestInterceptor())
+    sign_chain.append_request_interceptor(api_client.sign_request_interceptor)
     context = sign_chain.execute_request(context)
 
     return context.request.signed_query

byteplussdkcore/interceptor/interceptors/request.py

@@ -57,6 +57,10 @@ class Request(object):
         self.session_token = configuration.session_token
         self.region = configuration.region
         self.scheme = configuration.scheme
+        # Business proxy snapshot; credential routing belongs to ApiClient's binding.
+        self.proxy = configuration.proxy
+        self.http_proxy = configuration.http_proxy
+        self.https_proxy = configuration.https_proxy
         self.endpoint_provider = configuration.endpoint_provider
         self.custom_bootstrap_region = configuration.custom_bootstrap_region
         self.use_dual_stack = configuration.use_dual_stack
@@ -64,6 +68,7 @@ class Request(object):
         # ApiClient injects its private base retryer before interception.
         self.auto_retry = configuration.auto_retry
         self.retryer = None
+        # ApiClient replaces this with its persistent binding before signing.
         self.credential_provider = configuration.credential_provider
         self.invocation_id = str(uuid.uuid4())
         self.retry_count = 0

byteplussdkcore/rest.py

@@ -147,6 +147,11 @@ class RESTClientObject(object):
         )
 
         if proxy_url:
+            # urllib3 (v2) does not forward the ``user:password@`` embedded in
+            # the proxy URL as a Proxy-Authorization header, unlike Go's
+            # http.ProxyURL. Extract it explicitly so proxies requiring Basic
+            # auth work the same way across SDKs.
+            proxy_headers = self.__proxy_authorization_headers(proxy_url)
             self.pool_manager = urllib3.ProxyManager(
                 num_pools=pools_size,
                 maxsize=maxsize,
@@ -155,6 +160,7 @@ class RESTClientObject(object):
                 cert_file=configuration.cert_file,
                 key_file=configuration.key_file,
                 proxy_url=proxy_url,
+                proxy_headers=proxy_headers,
                 timeout=timeout,
                 retries=Retry(total=False),
                 **addition_pool_args
@@ -191,6 +197,27 @@ class RESTClientObject(object):
                     proxy_url = os.getenv('https_proxy')
         return proxy_url
 
+    @staticmethod
+    def __proxy_authorization_headers(proxy_url):
+        """Build proxy_headers carrying Proxy-Authorization, or None.
+
+        Returns a dict ``{'Proxy-Authorization': 'Basic ...'}`` when the proxy
+        URL embeds a ``user:password@`` userinfo, otherwise None (so urllib3
+        keeps its default empty proxy headers). Never raises: a malformed proxy
+        URL simply yields no auth header and lets the connection attempt (and
+        its clearer downstream error) proceed.
+        """
+        try:
+            from byteplussdkcore.auth.sts_http_config import (
+                build_proxy_authorization_header,
+            )
+            value = build_proxy_authorization_header(proxy_url)
+        except Exception:
+            return None
+        if not value:
+            return None
+        return {"Proxy-Authorization": value}
+
     def request(self, method, url, query_params=None, headers=None,
                 body=None, post_params=None, _preload_content=True,
                 _request_timeout=None):

byteplussdkcore/retryer/retry_condition.py

@@ -1,10 +1,13 @@
+import errno
 import json
 import logging
 import socket
+import ssl
 import traceback
 from abc import abstractmethod
 
 import urllib3
+from six.moves.http_client import BadStatusLine
 
 from byteplussdkcore.observability.debugger import sdk_core_logger
 from byteplussdkcore.rest import ApiException, RESTResponse
@@ -73,7 +76,7 @@ class DefaultRetryCondition(RetryCondition):
         Returns:
             bool: True if the request should be retried, False otherwise.
         """
-        if err is not None and isinstance(err, self.__retry_exceptions):
+        if err is not None and self._is_retryable_exception(err):
             sdk_core_logger.debug_retry("retry for retryable exception, err: %s", err)
             return True
 
@@ -105,6 +108,31 @@ class DefaultRetryCondition(RetryCondition):
         sdk_core_logger.debug_retry("no need to retry")
         return False
 
+    @classmethod
+    def _is_retryable_exception(cls, err):
+        # Retry the underlying connection failure, not every proxy failure.
+        # In particular, a CONNECT 407 or a TLS/configuration error must stop.
+        seen = set()
+        while isinstance(err, (urllib3.exceptions.ProxyError, urllib3.exceptions.MaxRetryError)):
+            if id(err) in seen:
+                return False
+            seen.add(id(err))
+            if isinstance(err, urllib3.exceptions.ProxyError):
+                err = err.original_error
+            else:
+                err = err.reason
+        if isinstance(err, (ssl.SSLError, urllib3.exceptions.SSLError)):
+            return False
+        if isinstance(err, cls.__retry_exceptions):
+            return True
+        # RemoteDisconnected on Python 3, empty BadStatusLine on Python 2.
+        if isinstance(err, BadStatusLine) and err.line in ("", "''"):
+            return True
+        return isinstance(err, socket.error) and err.errno in (
+            errno.ECONNRESET, errno.ECONNREFUSED, errno.ECONNABORTED,
+            errno.EPIPE, errno.ETIMEDOUT, errno.ENETUNREACH, errno.EHOSTUNREACH,
+        )
+
     @staticmethod
     def __json_loads(data):
         """

byteplussdkecopartner/__init__.py

@@ -26,13 +26,23 @@ from byteplussdkecopartner.models.create_invitation_link_response import CreateI
 from byteplussdkecopartner.models.create_unique_invitation_link_request import CreateUniqueInvitationLinkRequest
 from byteplussdkecopartner.models.create_unique_invitation_link_response import CreateUniqueInvitationLinkResponse
 from byteplussdkecopartner.models.customer_for_get_customer_details_by_type_output import CustomerForGetCustomerDetailsByTypeOutput
+from byteplussdkecopartner.models.download_bill_request import DownloadBillRequest
+from byteplussdkecopartner.models.download_bill_response import DownloadBillResponse
+from byteplussdkecopartner.models.file_for_download_bill_output import FileForDownloadBillOutput
 from byteplussdkecopartner.models.get_customer_details_by_type_request import GetCustomerDetailsByTypeRequest
 from byteplussdkecopartner.models.get_customer_details_by_type_response import GetCustomerDetailsByTypeResponse
 from byteplussdkecopartner.models.get_customer_details_by_uid_request import GetCustomerDetailsByUIDRequest
 from byteplussdkecopartner.models.get_customer_details_by_uid_response import GetCustomerDetailsByUIDResponse
 from byteplussdkecopartner.models.get_quota_information_request import GetQuotaInformationRequest
 from byteplussdkecopartner.models.get_quota_information_response import GetQuotaInformationResponse
+from byteplussdkecopartner.models.initiate_bill_generation_request import InitiateBillGenerationRequest
+from byteplussdkecopartner.models.initiate_bill_generation_response import InitiateBillGenerationResponse
+from byteplussdkecopartner.models.item_for_list_billing_items_output import ItemForListBillingItemsOutput
+from byteplussdkecopartner.models.list_billing_items_request import ListBillingItemsRequest
+from byteplussdkecopartner.models.list_billing_items_response import ListBillingItemsResponse
 from byteplussdkecopartner.models.modify_quota_request import ModifyQuotaRequest
 from byteplussdkecopartner.models.modify_quota_response import ModifyQuotaResponse
 from byteplussdkecopartner.models.settle_quota_payment_request import SettleQuotaPaymentRequest
 from byteplussdkecopartner.models.settle_quota_payment_response import SettleQuotaPaymentResponse
+from byteplussdkecopartner.models.task_for_download_bill_output import TaskForDownloadBillOutput
+from byteplussdkecopartner.models.total_for_list_billing_items_output import TotalForListBillingItemsOutput