clue-api 1.7.0.dev433__tar.gz → 1.7.0.dev446__tar.gz

{clue_api-1.7.0.dev433 → clue_api-1.7.0.dev446}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: clue-api
-Version: 1.7.0.dev433
+Version: 1.7.0.dev446
 Summary: Clue distributed enrichment service
 License: MIT
 License-File: LICENSE

{clue_api-1.7.0.dev433 → clue_api-1.7.0.dev446}/clue/api/v1/actions.py

@@ -8,7 +8,7 @@ List and execute actions
 
 from flask_cors import CORS
 
-from clue.api import internal_error, make_subapi_blueprint, not_found, ok
+from clue.api import internal_error, make_subapi_blueprint, not_found, ok, service_unavailable
 from clue.common.exceptions import ClueException, NotFoundException
 from clue.common.logging import get_logger
 from clue.common.swagger import generate_swagger_docs
@@ -22,7 +22,7 @@ logger = get_logger(__file__)
 
 SUB_API = "actions"
 actions_api = make_subapi_blueprint(SUB_API, api_version=1)
-actions_api._doc = "Run actions on data through configured external data sources/systems."
+actions_api._doc = "Run actions on data through configured external data sources/systems."  # type: ignore
 
 CORS(actions_api, origins=config.ui.cors_origins, supports_credentials=True)
 
@@ -122,4 +122,6 @@ def get_action_status(plugin_id: str, action_id: str, task_id: str, **kwargs) ->
     except NotFoundException as err:
         return not_found(err=err.message)
     except ClueException as err:
+        if err.status_code == 503:
+            return service_unavailable(err=err.message)
         return internal_error(err=err.message)

{clue_api-1.7.0.dev433 → clue_api-1.7.0.dev446}/clue/api/v1/fetchers.py

@@ -8,7 +8,7 @@ List and execute fetchers that provide data to be rendered client-side
 
 from flask_cors import CORS
 
-from clue.api import bad_gateway, bad_request, make_subapi_blueprint, not_found, ok
+from clue.api import bad_gateway, bad_request, make_subapi_blueprint, not_found, ok, service_unavailable
 from clue.common.exceptions import ClueException, NotFoundException
 from clue.common.logging import get_logger
 from clue.common.swagger import generate_swagger_docs
@@ -120,6 +120,8 @@ def get_fetcher_status(plugin_id: str, fetcher_id: str, task_id: str, **kwargs):
     except NotFoundException as err:
         return not_found(err=err.message)
     except ClueException as err:
+        if err.status_code == 503:
+            return service_unavailable(err=err.message)
         if err.status_code == 400:
             logger.warning(
                 "Bad request from fetcher %s.%s with task_id: %s: %s", plugin_id, fetcher_id, task_id, err.message

{clue_api-1.7.0.dev433 → clue_api-1.7.0.dev446}/clue/constants/supported_types.py

@@ -25,6 +25,7 @@ SUPPORTED_TYPES = {
     "ipv6": IPV6_ONLY_REGEX,
     # We don't auto-detect ip types, as it's redundant with ipv4/v6. This is just a convenience/backwards compat thing
     "ip": None,
+    "asn": None,
     "domain": DOMAIN_ONLY_REGEX,
     "port": PORT_REGEX,
     "url": URI_ONLY,

{clue_api-1.7.0.dev433 → clue_api-1.7.0.dev446}/clue/helper/headers.py

@@ -1,11 +1,10 @@
 from clue.common.logging import get_logger
-from clue.config import DEBUG, cache, config
+from clue.config import config
 
 logger = get_logger(__file__)
 
 
-@cache.memoize(timeout=1 if DEBUG else 5 * 60)  # Cached for 5 minutes
-def generate_headers(access_token: str | None, clue_access_token: str | None) -> dict[str, str]:
+def generate_headers(obo_access_token: str | None, access_token: str | None) -> dict[str, str]:
     """Generates the request headers.
 
     Args:
@@ -19,12 +18,12 @@ def generate_headers(access_token: str | None, clue_access_token: str | None) ->
         "content-type": "application/json",
     }
 
-    if access_token:
+    if obo_access_token or access_token:
         logger.debug("Appending authorization header")
-        _headers["Authorization"] = f"Bearer {access_token}"
+        _headers["Authorization"] = f"Bearer {obo_access_token or access_token}"
 
-    if config.auth.propagate_clue_key and clue_access_token:
+    if config.auth.propagate_clue_key and obo_access_token and access_token:
         logger.debug("Appending custom authorization header")
-        _headers["X-Clue-Authorization"] = clue_access_token
+        _headers["X-Clue-Authorization"] = access_token
 
     return _headers

clue_api-1.7.0.dev446/clue/helper/obo.py

@@ -0,0 +1,31 @@
+from typing import Any, Optional
+
+from flask import has_request_context, request
+
+from clue.common.exceptions import AuthenticationException
+from clue.common.logging import get_logger
+from clue.models.config import ExternalSource
+from clue.services import auth_service
+
+logger = get_logger(__file__)
+
+
+def get_obo_access_token(
+    source: ExternalSource, user: dict[str, Any], access_token: Optional[str] = None
+) -> tuple[Optional[str], Optional[str]]:
+    """Get the caller access token and an OBO token for an external source when needed."""
+    if access_token is None and has_request_context():
+        auth_header = request.headers.get("Authorization", type=str)
+        if auth_header:
+            parts = auth_header.split(" ", 1)
+            access_token = parts[1] if len(parts) == 2 else auth_header
+
+    if not access_token:
+        return None, None
+
+    obo_access_token, error = auth_service.check_obo(source, access_token, user["uname"])
+    if error:
+        logger.error("%s: %s", source.name, error)
+        raise AuthenticationException("Invalid token provided for this enrichment.")
+
+    return access_token, obo_access_token

{clue_api-1.7.0.dev433 → clue_api-1.7.0.dev446}/clue/services/action_service.py

@@ -1,80 +1,76 @@
-from typing import Any, Optional
+from time import monotonic
+from typing import Any
 from urllib.parse import urljoin
 
 import requests
 from elasticapm.traces import capture_span
 from flask import request
-from pydantic import TypeAdapter, ValidationError
+from pydantic import TypeAdapter
 from requests import JSONDecodeError, exceptions
 
-from clue.common.exceptions import ClueException, NotFoundException
+from clue.common.exceptions import AuthenticationException, ClueException, NotFoundException
 from clue.common.logging import get_logger
 from clue.config import CLASSIFICATION, config
 from clue.helper.headers import generate_headers
+from clue.helper.obo import get_obo_access_token
 from clue.helper.plugin_requests import request_with_safe_redirects
 from clue.models.actions import ActionResult, ActionSpec
 from clue.models.config import ExternalSource
-from clue.services import auth_service
 
 logger = get_logger(__file__)
 
 
+def _raise_action_metadata_unavailable(error: Exception | None = None) -> None:
+    raise ClueException(
+        "Unable to verify action availability with the upstream source.", error, status_code=503
+    ) from error
+
+
 def get_supported_actions(
-    source: ExternalSource, user: dict[str, Any], access_token: Optional[str] = None
+    source: ExternalSource,
+    headers: dict[str, str],
+    *,
+    timeout: float = 10.0,
+    raise_on_error: bool = False,
 ) -> dict[str, ActionSpec]:
     """Gets all supported actions for a source
 
     Args:
-        source_url (str): The URL of the source
-        access_token (Optional[str], optional): The access token to use, if necessary. Defaults to None.
+        source (ExternalSource): The source whose actions to retrieve.
+        headers (dict[str, str]): Headers to include in the upstream request.
+        timeout (float): The upstream request timeout in seconds.
+        raise_on_error (bool): Raise a 503 when metadata cannot be verified.
 
     Returns:
         dict[str, ActionSpec]: A dict of each action and their schema
     """
     logger.info("Fetching actions for source %s", source.name)
-
     url = urljoin(source.url, "actions/")
 
-    obo_access_token = None
-    if access_token:
-        obo_access_token, error = auth_service.check_obo(source, access_token, user["uname"])
-
-        if error:
-            logger.error("%s: %s", source.name, error)
-            return {}
-
-    headers = generate_headers(obo_access_token or access_token, access_token if obo_access_token else None)
-
     with capture_span(f"GET {url}", span_type="http"):
         rsp = None
         try:
-            rsp = request_with_safe_redirects(requests.get, url, headers=headers, timeout=10.0)
+            rsp = request_with_safe_redirects(requests.get, url, headers=headers, timeout=timeout)
             result = rsp.json()
 
             if not rsp.ok:
                 err = result["api_error_message"]
                 logger.error(f"Error from upstream server: {rsp.status_code=}, {err=}")
+                if raise_on_error:
+                    _raise_action_metadata_unavailable()
+                return {}
 
             return TypeAdapter(dict[str, ActionSpec]).validate_python(result["api_response"])
-        except (exceptions.ConnectionError, exceptions.Timeout):
-            # any errors are logged and no result is saved to local cache to enable retry on next query
-            logger.exception("Unable to connect: %s", url)
-            return {}
-        except (requests.exceptions.JSONDecodeError, KeyError, JSONDecodeError):
-            logger.exception(
-                "External API did not return expected format. Full data:\n\n%s\n\nStack Trace:",
-                rsp.text if rsp else "None",
-            )
-            return {}
-        except ValidationError:
-            logger.exception("ValidationError in response from %s:\n%s", source.url)
-            return {}
-        except Exception:
-            logger.exception("Unknown exception occurred on action fetching:")
+        except ClueException:
+            raise
+        except Exception as err:
+            logger.exception("Unable to retrieve action metadata from %s", source.url)
+            if raise_on_error:
+                _raise_action_metadata_unavailable(err)
             return {}
 
 
-def all_supported_actions(user: dict[str, Any], access_token: Optional[str] = None) -> dict[str, ActionSpec]:
+def all_supported_actions(user: dict[str, Any]) -> dict[str, ActionSpec]:
     """Gets all supported actions for all sources
 
     Args:
@@ -86,7 +82,17 @@ def all_supported_actions(user: dict[str, Any], access_token: Optional[str] = No
     all_actions: dict[str, ActionSpec] = {}
 
     for source in config.api.external_sources:
-        supported_actions = get_supported_actions(source, user, access_token=access_token)
+        if not CLASSIFICATION.is_accessible(user["classification"], source.classification):
+            continue
+
+        try:
+            access_token, obo_access_token = get_obo_access_token(source, user)
+        except AuthenticationException:
+            continue
+
+        supported_actions = get_supported_actions(
+            source, generate_headers(obo_access_token=obo_access_token, access_token=access_token)
+        )
         total_actions = 0
         for key, action in supported_actions.items():
             total_actions += 1
@@ -100,14 +106,7 @@ def get_plugins_supported_actions(user: dict[str, Any]) -> dict[str, ActionSpec]
     """Return the supported actions of each external service, filtered to what the user has access to."""
     available_actions: dict[str, ActionSpec] = {}
 
-    access_token = request.headers.get("Authorization", type=str)
-    if access_token:
-        access_token = access_token.split(" ")[1]
-
-    all_actions = all_supported_actions(
-        user,
-        access_token=access_token,
-    )
+    all_actions = all_supported_actions(user)
 
     logger.info("Fetching actions for classification %s", user["classification"])
 
@@ -144,22 +143,19 @@ def execute_action(plugin_id: str, action_id: str, user: dict[str, Any]) -> Acti
     """
     plugin = next((source for source in config.api.external_sources if source.name == plugin_id), None)
 
-    if not plugin:
-        raise NotFoundException(f"Plugin {plugin_id} does not exist.")
-
-    access_token = request.headers.get("Authorization", type=str)
-    if access_token:
-        access_token = access_token.split(" ")[1]
+    if not plugin or not CLASSIFICATION.is_accessible(user["classification"], plugin.classification):
+        raise NotFoundException("Action not found.", status_code=404)
 
-    obo_access_token = None
-    if access_token:
-        obo_access_token, error = auth_service.check_obo(plugin, access_token, user["uname"])
+    try:
+        access_token, obo_access_token = get_obo_access_token(plugin, user)
+    except AuthenticationException:
+        return ActionResult(outcome="failure", summary="Invalid token provided for this enrichment.")
 
-        if error:
-            logger.error("%s: %s", plugin.name, error)
-            return ActionResult(outcome="failure", summary="Invalid token provided for this enrichment.")
+    headers = generate_headers(obo_access_token=obo_access_token, access_token=access_token)
 
-    headers = generate_headers(obo_access_token or access_token, access_token if obo_access_token else None)
+    action = get_supported_actions(plugin, headers).get(action_id)
+    if action is None or not CLASSIFICATION.is_accessible(user["classification"], action.classification):
+        raise NotFoundException("Action not found.", status_code=404)
 
     if request.content_type == "application/json":
         parameters = request.json
@@ -211,22 +207,29 @@ def get_action_status(plugin_id: str, action_id: str, task_id: str, user: dict[s
     """
     plugin = next((source for source in config.api.external_sources if source.name == plugin_id), None)
 
-    if not plugin:
-        raise NotFoundException(f"Plugin {plugin_id} does not exist.")
-
-    access_token = request.headers.get("Authorization", type=str)
-    if access_token:
-        access_token = access_token.split(" ")[1]
-
-    obo_access_token = None
-    if access_token:
-        obo_access_token, error = auth_service.check_obo(plugin, access_token, user["uname"])
+    if not plugin or not CLASSIFICATION.is_accessible(user["classification"], plugin.classification):
+        raise NotFoundException("Action not found.", status_code=404)
 
-        if error:
-            logger.error("%s: %s", plugin.name, error)
-            return ActionResult(outcome="failure", summary="Invalid token provided.")
-
-    headers = generate_headers(obo_access_token or access_token, access_token if obo_access_token else None)
+    try:
+        access_token, obo_access_token = get_obo_access_token(plugin, user)
+    except AuthenticationException:
+        return ActionResult(outcome="failure", summary="Invalid token provided.")
+
+    headers = generate_headers(obo_access_token=obo_access_token, access_token=access_token)
+
+    timeout = request.args.get("max_timeout", plugin.default_timeout, type=float)
+    metadata_started = monotonic()
+    # Authorization metadata must stay fresh; include this lookup in the caller's timeout budget.
+    action = get_supported_actions(
+        plugin,
+        headers,
+        timeout=max(min(timeout, 10.0), 0.001),
+        raise_on_error=True,
+    ).get(action_id)
+    if action is None or not CLASSIFICATION.is_accessible(user["classification"], action.classification):
+        raise NotFoundException("Action not found.", status_code=404)
+
+    remaining_timeout = max(timeout - (monotonic() - metadata_started), 0.001)
 
     try:
         req_url = urljoin(plugin.url, f"actions/{action_id}/status/{task_id}")
@@ -236,7 +239,7 @@ def get_action_status(plugin_id: str, action_id: str, task_id: str, user: dict[s
             requests.get,
             req_url,
             headers=headers,
-            timeout=request.args.get("max_timeout", plugin.default_timeout, type=float),
+            timeout=remaining_timeout,
         )
 
         result = response.json()

{clue_api-1.7.0.dev433 → clue_api-1.7.0.dev446}/clue/services/auth_service.py

@@ -283,7 +283,7 @@ def basic_auth(data: str, is_base64: bool = True) -> AuthResult:
 
 
 # TODO: sa-clue support
-def check_obo(source: ExternalSource, access_token: str, username: str) -> tuple[Optional[str], Optional[str]]:
+def check_obo(source: ExternalSource, access_token: str | None, username: str) -> tuple[Optional[str], Optional[str]]:
     """Checks whether a token's audience matches the source, and if it doesn't, tries to get an OBO token for the source
 
     Args:
@@ -295,16 +295,16 @@ def check_obo(source: ExternalSource, access_token: str, username: str) -> tuple
         tuple[Optional[str], Optional[str]]: A tuple with either the valid access token in the first arg, or the error
             message in the second arg.
     """
-    obo_access_token: Optional[str] = None
+    obo_access_token: str | None = None
     if source.obo_target:
         logger.debug("Source %s requires OBO to %s", source.name, source.obo_target)
 
-        if "." not in access_token:
+        if access_token and "." not in access_token:
             logger.warning("JWT not provided, using service account.")
-            if not (sa_token := jwt_service.fetch_sa_token()):
-                return None, None
+            access_token = jwt_service.fetch_sa_token()
 
-            access_token = sa_token
+        if not access_token:
+            return None, "Valid access token not provided."
 
         audience = jwt_service.extract_audience(access_token)
 

{clue_api-1.7.0.dev433 → clue_api-1.7.0.dev446}/clue/services/fetcher_service.py

@@ -1,9 +1,10 @@
-from typing import Any, Optional
+from time import monotonic
+from typing import Any
 from urllib.parse import urljoin
 
 import requests
 from elasticapm.traces import capture_span
-from flask import has_request_context, request
+from flask import request
 from pydantic import TypeAdapter, ValidationError
 from requests import JSONDecodeError, exceptions
 
@@ -15,48 +16,37 @@ from clue.common.exceptions import (
     NotFoundException,
 )
 from clue.common.logging import get_logger
-from clue.config import CLASSIFICATION, DEBUG, cache, config
+from clue.config import CLASSIFICATION, config
+from clue.helper.headers import generate_headers
+from clue.helper.obo import get_obo_access_token
 from clue.helper.plugin_requests import request_with_safe_redirects
 from clue.models.config import ExternalSource
 from clue.models.fetchers import FetcherDefinition, FetcherResult
 from clue.models.selector import Selector
-from clue.services import auth_service
 
 logger = get_logger(__file__)
 
-# Either cache for one second in debug mode, or five minutes in production
-CACHE_TIMEOUT: int = 1 if DEBUG else 5 * 60
 
+def _raise_fetcher_metadata_unavailable(error: Exception | None = None) -> None:
+    raise ClueException(
+        "Unable to verify fetcher availability with the upstream source.", error, status_code=503
+    ) from error
 
-def get_obo_access_token(
-    source: ExternalSource, user: dict[str, Any], access_token: Optional[str] = None
-) -> tuple[Optional[str], Optional[str]]:
-    """Get the caller access token and an OBO token for an external source when needed."""
-    if access_token is None and has_request_context():
-        auth_header = request.headers.get("Authorization", type=str)
-        if auth_header:
-            parts = auth_header.split(" ", 1)
-            access_token = parts[1] if len(parts) == 2 and parts[0].lower() == "bearer" else auth_header
-    if not access_token:
-        return None, None
 
-    obo_access_token, error = auth_service.check_obo(source, access_token, user["uname"])
-    if error:
-        logger.error("%s: %s", source.name, error)
-        raise AuthenticationException("Invalid token provided for this enrichment.")
-
-    return access_token, obo_access_token
-
-
-@cache.memoize(timeout=1 if DEBUG else 5 * 60, args_to_ignore=["access_token"])  # Cached for 5 minutes
 def get_supported_fetchers(
-    source: ExternalSource, user: dict[str, Any], access_token: Optional[str] = None
+    source: ExternalSource,
+    headers: dict[str, str],
+    *,
+    timeout: float = 5.0,
+    raise_on_error: bool = False,
 ) -> dict[str, FetcherDefinition]:
-    """Gets all supported fetchers for a source
+    """Fetch current metadata without caching authorization classifications.
 
     Args:
-        source_url (str): The URL of the source
-        access_token (Optional[str], optional): The access token to use, if necessary. Defaults to None.
+        source (ExternalSource): The source whose fetchers to retrieve.
+        headers (dict[str, str]): Headers to include in the upstream request.
+        timeout (float): The upstream request timeout in seconds.
+        raise_on_error (bool): Raise a 503 when metadata cannot be verified.
 
     Returns:
         dict[str, FetcherDefinition]: A dict of each ids mapped to fetcher metadata
@@ -65,42 +55,33 @@ def get_supported_fetchers(
 
     url = urljoin(source.url, "fetchers/")
 
-    try:
-        access_token, obo_access_token = get_obo_access_token(source, user, access_token)
-    except AuthenticationException:
-        return {}
-
-    headers = {"Accept": "application/json"}
-    if obo_access_token or access_token:
-        headers["Authorization"] = f"Bearer {obo_access_token or access_token}"
-
     with capture_span(f"GET {url}", span_type="http"):
         try:
-            rsp = request_with_safe_redirects(requests.get, url, headers=headers, timeout=5.0)
+            rsp = request_with_safe_redirects(requests.get, url, headers=headers, timeout=timeout)
             result = rsp.json()
 
             if not rsp.ok:
                 err = result["api_error_message"]
                 logger.error(f"Error from upstream server: {rsp.status_code=}, {err=}")
+                if raise_on_error:
+                    _raise_fetcher_metadata_unavailable()
+                return {}
 
             return TypeAdapter(dict[str, FetcherDefinition]).validate_python(result["api_response"])
-        except (exceptions.ConnectionError, exceptions.Timeout):
-            # any errors are logged and no result is saved to local cache to enable retry on next query
-            logger.exception("Unable to connect: %s", url)
-            return {}
-        except (requests.exceptions.JSONDecodeError, KeyError):
-            logger.exception("External API did not return expected format:")
-            return {}
-        except ValidationError:
-            logger.exception("ValidationError in response from %s:", source.url)
+        except ClueException:
+            raise
+        except Exception as err:
+            logger.exception("Unable to retrieve fetcher metadata from %s", source.url)
+            if raise_on_error:
+                _raise_fetcher_metadata_unavailable(err)
             return {}
 
 
-def all_supported_fetchers(user: dict[str, Any], access_token: Optional[str] = None) -> dict[str, FetcherDefinition]:
+def all_supported_fetchers(user: dict[str, Any]) -> dict[str, FetcherDefinition]:
     """Gets all supported fetchers for all sources
 
     Args:
-        access_token (Optional[str], optional): The access token to use, if necessary. Defaults to None.
+        user (dict[str, Any]): The user requesting the fetchers.
 
     Returns:
         dict[str, FetcherDefinition]: A dict of all fetchers and their matching schema
@@ -108,7 +89,17 @@ def all_supported_fetchers(user: dict[str, Any], access_token: Optional[str] = N
     all_fetchers: dict[str, FetcherDefinition] = {}
 
     for source in config.api.external_sources:
-        supported_fetchers = get_supported_fetchers(source, user, access_token=access_token)
+        if not CLASSIFICATION.is_accessible(user["classification"], source.classification):
+            continue
+
+        try:
+            access_token, obo_access_token = get_obo_access_token(source, user)
+        except AuthenticationException:
+            continue
+
+        supported_fetchers = get_supported_fetchers(
+            source, generate_headers(obo_access_token=obo_access_token, access_token=access_token)
+        )
         total_fetchers = 0
         for key, action in supported_fetchers.items():
             total_fetchers += 1
@@ -122,14 +113,7 @@ def get_plugins_supported_fetchers(user: dict[str, Any]) -> dict[str, FetcherDef
     """Return the supported fetchers of each external service, filtered to what the user has access to."""
     available_fetchers: dict[str, FetcherDefinition] = {}
 
-    access_token = request.headers.get("Authorization", type=str)
-    if access_token:
-        access_token = access_token.split(" ")[1]
-
-    all_fetchers = all_supported_fetchers(
-        user,
-        access_token=access_token,
-    )
+    all_fetchers = all_supported_fetchers(user)
 
     logger.info("Retrieving fetchers for classification %s", user["classification"])
 
@@ -175,14 +159,12 @@ def run_fetcher(plugin_id: str, fetcher_id: str, user: dict[str, Any]) -> Fetche
     """
     plugin = next((source for source in config.api.external_sources if source.name == plugin_id), None)
 
-    if not plugin:
-        raise NotFoundException(f"Plugin {plugin_id} does not exist.")
+    if not plugin or not CLASSIFICATION.is_accessible(user["classification"], plugin.classification):
+        raise NotFoundException("Fetcher not found.", status_code=404)
 
     access_token, obo_access_token = get_obo_access_token(plugin, user)
 
-    headers = {"Accept": "application/json"}
-    if obo_access_token or access_token:
-        headers["Authorization"] = f"Bearer {obo_access_token or access_token}"
+    headers = generate_headers(obo_access_token=obo_access_token, access_token=access_token)
 
     if request.is_json:
         parameters = request.json
@@ -197,14 +179,11 @@ def run_fetcher(plugin_id: str, fetcher_id: str, user: dict[str, Any]) -> Fetche
 
     try:
         selector = Selector.model_validate(parameters)
-        supported_fetchers = get_supported_fetchers(plugin, user, access_token=access_token)
-
-        if len(supported_fetchers) < 1:
-            raise NotFoundException(f"{plugin_id} does not support any fetchers.")
+        supported_fetchers = get_supported_fetchers(plugin, headers)
 
         fetcher = supported_fetchers.get(fetcher_id)
-        if fetcher is None:
-            raise NotFoundException(f"Fetcher {fetcher_id} does not exist", status_code=404)
+        if fetcher is None or not CLASSIFICATION.is_accessible(user["classification"], fetcher.classification):
+            raise NotFoundException("Fetcher not found.", status_code=404)
         _validate_fetcher_classification(fetcher, selector, fetcher_id)
 
         response = request_with_safe_redirects(
@@ -255,14 +234,26 @@ def get_fetcher_status(plugin_id: str, fetcher_id: str, task_id: str, user: dict
     """
     plugin = next((source for source in config.api.external_sources if source.name == plugin_id), None)
 
-    if not plugin:
-        raise NotFoundException(f"Plugin {plugin_id} does not exist.")
+    if not plugin or not CLASSIFICATION.is_accessible(user["classification"], plugin.classification):
+        raise NotFoundException("Fetcher not found.", status_code=404)
 
     access_token, obo_access_token = get_obo_access_token(plugin, user)
 
-    headers = {"Accept": "application/json"}
-    if obo_access_token or access_token:
-        headers["Authorization"] = f"Bearer {obo_access_token or access_token}"
+    headers = generate_headers(obo_access_token=obo_access_token, access_token=access_token)
+
+    timeout = request.args.get("max_timeout", 60.0, type=float)
+    metadata_started = monotonic()
+    # Authorization metadata must stay fresh; include this lookup in the caller's timeout budget.
+    fetcher = get_supported_fetchers(
+        plugin,
+        headers,
+        timeout=max(min(timeout, 5.0), 0.001),
+        raise_on_error=True,
+    ).get(fetcher_id)
+    if fetcher is None or not CLASSIFICATION.is_accessible(user["classification"], fetcher.classification):
+        raise NotFoundException("Fetcher not found.", status_code=404)
+
+    remaining_timeout = max(timeout - (monotonic() - metadata_started), 0.001)
 
     try:
         req_url = urljoin(plugin.url, f"fetchers/{fetcher_id}/status/{task_id}")
@@ -272,7 +263,7 @@ def get_fetcher_status(plugin_id: str, fetcher_id: str, task_id: str, user: dict
             requests.get,
             req_url,
             headers=headers,
-            timeout=request.args.get("max_timeout", 60.0, type=float),
+            timeout=remaining_timeout,
         )
 
         result = response.json()