cmsdials 2.1.0__tar.gz → 2.3.0__tar.gz

{cmsdials-2.1.0 → cmsdials-2.3.0}/.gitlab-ci.yml

@@ -81,7 +81,9 @@ test_matrix:
         coverage_format: cobertura
         path: coverage.xml
   variables:
-    SECRET_KEY: "$SECRET_KEY"
+    CLIENT_SECRET: "$CLIENT_SECRET"
+    # Application owning CLIENT_SECRET, enables the api-access token tests
+    CLIENT_ID: "cms-dials-dev-api-client-test"
   rules:
     - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
 

{cmsdials-2.1.0 → cmsdials-2.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cmsdials
-Version: 2.1.0
+Version: 2.3.0
 Summary: The Python api client interface to DIALS service
 Author-email: Gabriel Moreira <gabriel.moreira@cern.ch>
 Project-URL: Repository, https://gitlab.cern.ch/cms-dqmdc/libraries/dials-py
@@ -21,9 +21,9 @@ Provides-Extra: tqdm
 Requires-Dist: tqdm>=4.66.1; extra == "tqdm"
 Dynamic: license-file
 
-![Build Status](https://gitlab.cern.ch/cms-dqmdc/libraries/dials-py/badges/develop/pipeline.svg)
-![Coverage](https://gitlab.cern.ch/cms-dqmdc/libraries/dials-py/badges/develop/coverage.svg)
-![Latest Release](https://gitlab.cern.ch/cms-dqmdc/libraries/dials-py/-/badges/release.svg)
+![Build Status](https://gitlab.cern.ch/cms-ppd/technical-support/libraries/dials-py/badges/develop/pipeline.svg)
+![Coverage](https://gitlab.cern.ch/cms-ppd/technical-support/libraries/dials-py/badges/develop/coverage.svg)
+![Latest Release](https://gitlab.cern.ch/cms-ppd/technical-support/libraries/dials-py/-/badges/release.svg)
 [![PyPI version](https://badge.fury.io/py/cmsdials.png)](https://badge.fury.io/py/cmsdials)
 
 # dials-py
@@ -46,16 +46,29 @@ pandas, tqdm
 
 ## Usage
 
-Before interfacing with any route you need to generate valid credentials, it is possible to authenticate trough the `device authorization flow` or using the `client secret key` of any application registered in DIALS. Note that, the device flow is an interactively authentication procedure that is possible to distinguish users in DIALS backend and the client secret flow is not interactive and is not possible to distinguish users so it should only be used for automation scripts.
+Before interfacing with any route you need to generate valid credentials, it is possible to authenticate trough the `device authorization flow` or using the `client id and secret` of an application granted API access in DIALS. Note that, the device flow is an interactively authentication procedure that is possible to distinguish users in DIALS backend and the client secret flow is not interactive and is not possible to distinguish users so it should only be used for automation scripts.
+
+Credentials are issued by CERN's Keycloak directly, dials-py never sends your password or client secret to DIALS.
 
 ### Generating credentials with client secret
 
 ```python
 from cmsdials.auth.secret_key import Credentials
 
-creds = Credentials(token=".....")
+creds = Credentials(client_id="my-application", token=".....")
 ```
 
+The token is renewed automatically before it expires.
+
+To get API access:
+
+1. Register an application in the [CERN Application Portal](https://application-portal.web.cern.ch) and enable "My application will need to get tokens using its own client ID and secret".
+2. Ask the DIALS team to grant API access to the application (it is added to the DIALS API access group).
+3. Use the application's client id and secret as shown above.
+
+> [!WARNING]
+> `Credentials(token=".....")` without `client_id` authenticates with the `X-CLIENT-SECRET` header, which is deprecated and emits a `DeprecationWarning`. DIALS will stop accepting it, so pass the `client_id` of your application.
+
 ### Generating credentials with device
 
 #### Loading from AuthClient
@@ -298,9 +311,11 @@ You may need to query the `ml_models_index` client to fetch the models ids you a
 
 Attention: Those endpoints doesn't return a Pydantic model, instead they are returning a plain json response. Consequently, the method `to_pandas` doesn't work on them.
 
-## Usage with local DIALS
+## Usage with other DIALS instances
+
+All classes that interface the DIALS service inherit the class `BaseAPIClient`, which propagates the `base_url`, `route` and `version` attributes with production values. In order to use dials-py with another DIALS instance it is possible to overwrite those attributes when instantiating the `Dials` client.
 
-All classes that interface the DIALS service inherits the class `BaseAPIClient` which propagate the `base_url`, `route` and `version` attributes with production values. In order to use dials-py with a local version of DIALS it is possible to overwrite those attributes when instantiating the `AuthClient` and the `Dials` client, for example:
+The `AuthClient` issues tokens for the production DIALS applications by default. For another instance, overwrite the Keycloak public application (`client_id`) and the DIALS application the tokens are issued for (`audience`). The audience must be the `DJANGO_KEYCLOAK_CLIENT_ID` configured in that DIALS backend, and that application must allow token exchange from the public application. For example, with a local instance:
 
 ```python
 from cmsdials.auth.client import AuthClient
@@ -308,16 +323,36 @@ from cmsdials.auth.bearer import Credentials
 from cmsdials import Dials
 from cmsdials.filters import LumisectionHistogram2DFilters
 
-DEV_URL = "http://localhost:8000/"
-DEV_CACHE_DIR = ".cache-dev"
+CLIENT_ID = "<your_public_application>"
+AUDIENCE = "<your_confidential_application>"
+CACHE_DIR = ".cache-local"
+DIALS_URL = "http://localhost:8000/"
 
-auth = AuthClient(base_url=DEV_URL)
-creds = Credentials.from_creds_file(cache_dir=DEV_CACHE_DIR, client=auth)  # Make sure to specify the auth client with overwritten values, using another cache_dir is recommended
-dials = Dials(creds, base_url=DEV_URL)
+auth = AuthClient(client_id=CLIENT_ID, audience=AUDIENCE)
+creds = Credentials.from_creds_file(cache_dir=CACHE_DIR, client=auth)  # Make sure to specify the auth client with overwritten values, using another cache_dir is recommended
+dials = Dials(creds, base_url=DIALS_URL)
 
 dials.h2d.list_all(LumisectionHistogram2DFilters(me__regex="EEOT digi occupancy EE +", entries__gte=100, run_number__gte=360392, run_number__lte=365000), max_pages=5)
 ```
 
+When authenticating with a client secret, pass the same `AuthClient` so the token is issued for that instance:
+
+```python
+from cmsdials.auth.secret_key import Credentials as SecretKeyCredentials
+
+creds = SecretKeyCredentials(client_id="my-application", token=".....", client=auth)
+dials = Dials(creds, base_url=DIALS_URL)
+```
+
+To connect to the development instance of DIALS, use these values in the examples above:
+
+```python
+CLIENT_ID = "cms-dials-dev-public-app"
+AUDIENCE = "cms-dials-dev-confidential-app"
+CACHE_DIR = ".cache-dev"
+DIALS_URL = "https://dev-cmsdials-api.web.cern.ch/"
+```
+
 ## Development
 
 Install the dependencies and the package using `uv`:
@@ -333,15 +368,15 @@ uv pip install -e .
 The repository has some tests written to make sure DIALS responses are compatible with pydantic metaclasses, you can use pytest to run all tests but you need to specify a secret key to authenticate non-interactively against DIALS api:
 
 ```bash
-SECRET_KEY=... uv run pytest tests
+CLIENT_SECRET=... uv run pytest tests
 ```
 
-The secret key is an api client enabled secret key and can be obtained from the applications portal, any api client secret key whitelisted in DIALS can be used. The interactive authentication flow should be tested manually, an example for this can be found in [this line](/tests/integration/test_auth_client.py#L33).
+The secret key is an api client enabled secret key and can be obtained from the applications portal, any api client secret key whitelisted in DIALS can be used. Set `CLIENT_ID` to the client id of the same application to test the api-access token flow (`CLIENT_SECRET=... CLIENT_ID=... uv run pytest tests`); otherwise those tests are skipped and the deprecated `X-CLIENT-SECRET` header is used. Tests target the dev Keycloak applications by default, overwrite them with `AUTH_CLIENT_ID` and `AUTH_AUDIENCE`. The interactive authentication flow should be tested manually, an example for this can be found in [test_auth_client.py](/tests/integration/test_auth_client.py).
 
 If testing against a local version of DIALS you need to specify the BASE_URL:
 
 ```bash
-SECRET_KEY=... BASE_URL=http://localhost:8000 uv run pytest tests
+CLIENT_SECRET=... BASE_URL=http://localhost:8000 uv run pytest tests
 ```
 
 #### Tox
@@ -349,7 +384,7 @@ SECRET_KEY=... BASE_URL=http://localhost:8000 uv run pytest tests
 Tox is pre-configured in `tox.ini`, so you can run the following to test against multiple python versions locally:
 
 ```bash
-SECRET_KEY=... uv run tox
+CLIENT_SECRET=... uv run tox
 ```
 
 **[asdf](https://asdf-vm.com/) users**

{cmsdials-2.1.0 → cmsdials-2.3.0}/README.md

@@ -1,6 +1,6 @@
-![Build Status](https://gitlab.cern.ch/cms-dqmdc/libraries/dials-py/badges/develop/pipeline.svg)
-![Coverage](https://gitlab.cern.ch/cms-dqmdc/libraries/dials-py/badges/develop/coverage.svg)
-![Latest Release](https://gitlab.cern.ch/cms-dqmdc/libraries/dials-py/-/badges/release.svg)
+![Build Status](https://gitlab.cern.ch/cms-ppd/technical-support/libraries/dials-py/badges/develop/pipeline.svg)
+![Coverage](https://gitlab.cern.ch/cms-ppd/technical-support/libraries/dials-py/badges/develop/coverage.svg)
+![Latest Release](https://gitlab.cern.ch/cms-ppd/technical-support/libraries/dials-py/-/badges/release.svg)
 [![PyPI version](https://badge.fury.io/py/cmsdials.png)](https://badge.fury.io/py/cmsdials)
 
 # dials-py
@@ -23,16 +23,29 @@ pandas, tqdm
 
 ## Usage
 
-Before interfacing with any route you need to generate valid credentials, it is possible to authenticate trough the `device authorization flow` or using the `client secret key` of any application registered in DIALS. Note that, the device flow is an interactively authentication procedure that is possible to distinguish users in DIALS backend and the client secret flow is not interactive and is not possible to distinguish users so it should only be used for automation scripts.
+Before interfacing with any route you need to generate valid credentials, it is possible to authenticate trough the `device authorization flow` or using the `client id and secret` of an application granted API access in DIALS. Note that, the device flow is an interactively authentication procedure that is possible to distinguish users in DIALS backend and the client secret flow is not interactive and is not possible to distinguish users so it should only be used for automation scripts.
+
+Credentials are issued by CERN's Keycloak directly, dials-py never sends your password or client secret to DIALS.
 
 ### Generating credentials with client secret
 
 ```python
 from cmsdials.auth.secret_key import Credentials
 
-creds = Credentials(token=".....")
+creds = Credentials(client_id="my-application", token=".....")
 ```
 
+The token is renewed automatically before it expires.
+
+To get API access:
+
+1. Register an application in the [CERN Application Portal](https://application-portal.web.cern.ch) and enable "My application will need to get tokens using its own client ID and secret".
+2. Ask the DIALS team to grant API access to the application (it is added to the DIALS API access group).
+3. Use the application's client id and secret as shown above.
+
+> [!WARNING]
+> `Credentials(token=".....")` without `client_id` authenticates with the `X-CLIENT-SECRET` header, which is deprecated and emits a `DeprecationWarning`. DIALS will stop accepting it, so pass the `client_id` of your application.
+
 ### Generating credentials with device
 
 #### Loading from AuthClient
@@ -275,9 +288,11 @@ You may need to query the `ml_models_index` client to fetch the models ids you a
 
 Attention: Those endpoints doesn't return a Pydantic model, instead they are returning a plain json response. Consequently, the method `to_pandas` doesn't work on them.
 
-## Usage with local DIALS
+## Usage with other DIALS instances
+
+All classes that interface the DIALS service inherit the class `BaseAPIClient`, which propagates the `base_url`, `route` and `version` attributes with production values. In order to use dials-py with another DIALS instance it is possible to overwrite those attributes when instantiating the `Dials` client.
 
-All classes that interface the DIALS service inherits the class `BaseAPIClient` which propagate the `base_url`, `route` and `version` attributes with production values. In order to use dials-py with a local version of DIALS it is possible to overwrite those attributes when instantiating the `AuthClient` and the `Dials` client, for example:
+The `AuthClient` issues tokens for the production DIALS applications by default. For another instance, overwrite the Keycloak public application (`client_id`) and the DIALS application the tokens are issued for (`audience`). The audience must be the `DJANGO_KEYCLOAK_CLIENT_ID` configured in that DIALS backend, and that application must allow token exchange from the public application. For example, with a local instance:
 
 ```python
 from cmsdials.auth.client import AuthClient
@@ -285,16 +300,36 @@ from cmsdials.auth.bearer import Credentials
 from cmsdials import Dials
 from cmsdials.filters import LumisectionHistogram2DFilters
 
-DEV_URL = "http://localhost:8000/"
-DEV_CACHE_DIR = ".cache-dev"
+CLIENT_ID = "<your_public_application>"
+AUDIENCE = "<your_confidential_application>"
+CACHE_DIR = ".cache-local"
+DIALS_URL = "http://localhost:8000/"
 
-auth = AuthClient(base_url=DEV_URL)
-creds = Credentials.from_creds_file(cache_dir=DEV_CACHE_DIR, client=auth)  # Make sure to specify the auth client with overwritten values, using another cache_dir is recommended
-dials = Dials(creds, base_url=DEV_URL)
+auth = AuthClient(client_id=CLIENT_ID, audience=AUDIENCE)
+creds = Credentials.from_creds_file(cache_dir=CACHE_DIR, client=auth)  # Make sure to specify the auth client with overwritten values, using another cache_dir is recommended
+dials = Dials(creds, base_url=DIALS_URL)
 
 dials.h2d.list_all(LumisectionHistogram2DFilters(me__regex="EEOT digi occupancy EE +", entries__gte=100, run_number__gte=360392, run_number__lte=365000), max_pages=5)
 ```
 
+When authenticating with a client secret, pass the same `AuthClient` so the token is issued for that instance:
+
+```python
+from cmsdials.auth.secret_key import Credentials as SecretKeyCredentials
+
+creds = SecretKeyCredentials(client_id="my-application", token=".....", client=auth)
+dials = Dials(creds, base_url=DIALS_URL)
+```
+
+To connect to the development instance of DIALS, use these values in the examples above:
+
+```python
+CLIENT_ID = "cms-dials-dev-public-app"
+AUDIENCE = "cms-dials-dev-confidential-app"
+CACHE_DIR = ".cache-dev"
+DIALS_URL = "https://dev-cmsdials-api.web.cern.ch/"
+```
+
 ## Development
 
 Install the dependencies and the package using `uv`:
@@ -310,15 +345,15 @@ uv pip install -e .
 The repository has some tests written to make sure DIALS responses are compatible with pydantic metaclasses, you can use pytest to run all tests but you need to specify a secret key to authenticate non-interactively against DIALS api:
 
 ```bash
-SECRET_KEY=... uv run pytest tests
+CLIENT_SECRET=... uv run pytest tests
 ```
 
-The secret key is an api client enabled secret key and can be obtained from the applications portal, any api client secret key whitelisted in DIALS can be used. The interactive authentication flow should be tested manually, an example for this can be found in [this line](/tests/integration/test_auth_client.py#L33).
+The secret key is an api client enabled secret key and can be obtained from the applications portal, any api client secret key whitelisted in DIALS can be used. Set `CLIENT_ID` to the client id of the same application to test the api-access token flow (`CLIENT_SECRET=... CLIENT_ID=... uv run pytest tests`); otherwise those tests are skipped and the deprecated `X-CLIENT-SECRET` header is used. Tests target the dev Keycloak applications by default, overwrite them with `AUTH_CLIENT_ID` and `AUTH_AUDIENCE`. The interactive authentication flow should be tested manually, an example for this can be found in [test_auth_client.py](/tests/integration/test_auth_client.py).
 
 If testing against a local version of DIALS you need to specify the BASE_URL:
 
 ```bash
-SECRET_KEY=... BASE_URL=http://localhost:8000 uv run pytest tests
+CLIENT_SECRET=... BASE_URL=http://localhost:8000 uv run pytest tests
 ```
 
 #### Tox
@@ -326,7 +361,7 @@ SECRET_KEY=... BASE_URL=http://localhost:8000 uv run pytest tests
 Tox is pre-configured in `tox.ini`, so you can run the following to test against multiple python versions locally:
 
 ```bash
-SECRET_KEY=... uv run tox
+CLIENT_SECRET=... uv run tox
 ```
 
 **[asdf](https://asdf-vm.com/) users**

{cmsdials-2.1.0 → cmsdials-2.3.0}/cmsdials/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '2.1.0'
-__version_tuple__ = version_tuple = (2, 1, 0)
+__version__ = version = '2.3.0'
+__version_tuple__ = version_tuple = (2, 3, 0)
 
-__commit_id__ = commit_id = 'g4b3c689eb'
+__commit_id__ = commit_id = 'g044d28ceb'

{cmsdials-2.1.0 → cmsdials-2.3.0}/cmsdials/auth/bearer.py

@@ -4,6 +4,8 @@ import os.path
 from datetime import datetime
 from typing import Optional
 
+from requests.exceptions import HTTPError
+
 from ..utils._json import TokenDecoder, TokenEncoder
 from ..utils.logger import logger
 from ._base import BaseCredentials, TokenState
@@ -137,10 +139,32 @@ class Credentials(BaseCredentials):
         with open(fpath, "w") as filebuffer:
             json.dump(self._token.model_dump(), filebuffer, cls=TokenEncoder)
 
+    @staticmethod
+    def _is_invalid_grant(err: HTTPError) -> bool:
+        if err.response is None or err.response.status_code != 400:
+            return False
+        try:
+            return err.response.json().get("error") == "invalid_grant"
+        except ValueError:
+            return False
+
     def refresh(self) -> None:
-        token: Token = self.client.refresh_token(
-            self.token_type, self.token, self.refresh_token
-        )
+        try:
+            token: Token = self.client.refresh_token(
+                self.token_type, self.token, self.refresh_token
+            )
+        except HTTPError as err:
+            # Keycloak only accepts a refresh token from the client it was
+            # issued to. Credentials cached by releases that authenticated
+            # through DIALS hold refresh tokens of the DIALS confidential
+            # application, not the public one. Expired or revoked refresh
+            # tokens are rejected with the same error.
+            if not self._is_invalid_grant(err):
+                raise
+            logger.info(
+                "Refresh token rejected, triggering device authentication flow..."
+            )
+            token = self.client.device_auth_flow()
         self._set_token(token)
         self.cache_credentials()
 

cmsdials-2.3.0/cmsdials/auth/client.py

@@ -0,0 +1,198 @@
+import time
+from datetime import datetime, timedelta
+from typing import Optional
+
+import requests
+
+from ..utils.api_client import BaseAPIClient
+from ..utils.logger import logger
+from .exceptions import PendingAuthorizationError
+from .models import ApiToken, Device, Token
+
+
+class AuthClient(BaseAPIClient):
+    """
+    Client for CERN's Keycloak, issuing tokens accepted by DIALS.
+
+    Interactive users authenticate with the device authorization grant on the
+    public application, and the resulting token is exchanged for one with the
+    DIALS audience. Applications authenticate with their own client id and
+    secret on CERN's api-access endpoint, requesting the DIALS audience.
+
+    The defaults target the production DIALS instance. To use another one,
+    override `client_id` and `audience`, e.g. for dev:
+
+        AuthClient(
+            client_id="cms-dials-dev-public-app",
+            audience="cms-dials-dev-confidential-app",
+        )
+    """
+
+    default_timeout = 30  # seconds
+    PRODUCTION_KEYCLOAK_URL = "https://auth.cern.ch/auth/"
+    PRODUCTION_KEYCLOAK_REALM = "cern"
+    PRODUCTION_CLIENT_ID = "cms-dials-prod-public-app"
+    PRODUCTION_AUDIENCE = "cms-dials-prod-confidential-app"
+
+    DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code"
+    TOKEN_EXCHANGE_GRANT = "urn:ietf:params:oauth:grant-type:token-exchange"  # noqa: S105
+    ACCESS_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:access_token"  # noqa: S105
+
+    def __init__(
+        self,
+        *args,
+        keycloak_url: Optional[str] = None,
+        realm: Optional[str] = None,
+        client_id: Optional[str] = None,
+        audience: Optional[str] = None,
+        **kwargs,
+    ) -> None:
+        super().__init__(*args, **kwargs)
+        keycloak_url = keycloak_url or self.PRODUCTION_KEYCLOAK_URL
+        if not keycloak_url.endswith("/"):
+            keycloak_url += "/"
+        self.realm_url = (
+            f"{keycloak_url}realms/{realm or self.PRODUCTION_KEYCLOAK_REALM}/"
+        )
+        self.client_id = client_id or self.PRODUCTION_CLIENT_ID
+        self.audience = audience or self.PRODUCTION_AUDIENCE
+
+    @property
+    def token_url(self) -> str:
+        return self.realm_url + "protocol/openid-connect/token"
+
+    def _keycloak_post(self, url: str, data: dict) -> requests.Response:
+        return requests.post(
+            url=url,
+            headers={
+                "accept": "application/json",
+                "User-Agent": self._build_user_agent(),
+            },
+            data=data,
+            timeout=self.default_timeout,
+        )
+
+    def new_device(self) -> Device:
+        response = self._keycloak_post(
+            self.realm_url + "protocol/openid-connect/auth/device",
+            {"client_id": self.client_id},
+        )
+        response.raise_for_status()
+        return Device(**response.json())
+
+    def _exchange(self, public_token: dict) -> Token:
+        """
+        Exchange a token of the public application for one with the DIALS
+        audience. The refresh token kept is the public application's one,
+        since refreshing means refreshing it and exchanging again.
+        """
+        response = self._keycloak_post(
+            self.token_url,
+            {
+                "client_id": self.client_id,
+                "grant_type": self.TOKEN_EXCHANGE_GRANT,
+                "subject_token": public_token["access_token"],
+                "subject_token_type": self.ACCESS_TOKEN_TYPE,
+                "audience": self.audience,
+            },
+        )
+        response.raise_for_status()
+        exchanged = response.json()
+        curr_datetime = datetime.now()
+        return Token(
+            access_token=exchanged["access_token"],
+            expires_in=exchanged["expires_in"],
+            token_type=exchanged["token_type"],
+            refresh_token=public_token["refresh_token"],
+            refresh_expires_in=public_token["refresh_expires_in"],
+            expires_at=curr_datetime
+            + timedelta(seconds=exchanged["expires_in"]),
+            refresh_expires_at=curr_datetime
+            + timedelta(seconds=public_token["refresh_expires_in"]),
+        )
+
+    def device_token(self, device_code: str) -> Token:
+        response = self._keycloak_post(
+            self.token_url,
+            {
+                "client_id": self.client_id,
+                "grant_type": self.DEVICE_CODE_GRANT,
+                "device_code": device_code,
+            },
+        )
+
+        if response.status_code == 400 and response.json().get("error") in (
+            "authorization_pending",
+            "slow_down",
+        ):
+            raise PendingAuthorizationError
+
+        response.raise_for_status()
+        return self._exchange(response.json())
+
+    def refresh_token(
+        self, token_type: str, access_token: str, refresh_token: str
+    ) -> Token:
+        # token_type and access_token are kept for compatibility, refreshing
+        # only needs the public application's refresh token.
+        response = self._keycloak_post(
+            self.token_url,
+            {
+                "client_id": self.client_id,
+                "grant_type": "refresh_token",
+                "refresh_token": refresh_token,
+            },
+        )
+        response.raise_for_status()
+        return self._exchange(response.json())
+
+    def api_access_token(self, client_id: str, client_secret: str) -> ApiToken:
+        """
+        Issue a token for an application with its own client id and secret.
+        DIALS only accepts it if the application was granted API access.
+        """
+        response = self._keycloak_post(
+            self.realm_url + "api-access/token",
+            {
+                "grant_type": "client_credentials",
+                "client_id": client_id,
+                "client_secret": client_secret,
+                "audience": self.audience,
+            },
+        )
+        response.raise_for_status()
+        data = response.json()
+        return ApiToken(
+            access_token=data["access_token"],
+            expires_in=data["expires_in"],
+            token_type=data["token_type"],
+            expires_at=datetime.now() + timedelta(seconds=data["expires_in"]),
+        )
+
+    def device_auth_flow(self) -> Token:
+        interval = 5  # seconds
+        device = self.new_device()
+        end_date = datetime.now() + timedelta(seconds=device.expires_in)
+
+        logger.info(f"This device will expire in {device.expires_in} seconds.")
+        logger.info(
+            f"Go to the following url and authenticate: {device.verification_uri_complete}"
+        )
+        logger.info(
+            f"Checking authorization status every {interval} seconds..."
+        )
+
+        while True:
+            time.sleep(interval)
+            curr_date = datetime.now()
+            if curr_date > end_date:
+                raise Exception("Action took too much time, device expired!")
+
+            try:
+                token = self.device_token(device_code=device.device_code)
+                logger.info(
+                    "Device authorized, authentication finished successfully!"
+                )
+                return token
+            except PendingAuthorizationError:
+                logger.info("Device not authorized yet.")

{cmsdials-2.1.0 → cmsdials-2.3.0}/cmsdials/auth/models.py

@@ -23,3 +23,15 @@ RefreshToken = DeviceToken
 class Token(DeviceToken):
     expires_at: datetime
     refresh_expires_at: datetime
+
+
+class ApiToken(BaseModel):
+    """
+    Token issued with client credentials by CERN's api-access endpoint.
+    It carries no refresh token: a new one is requested once it expires.
+    """
+
+    access_token: str
+    expires_in: int
+    token_type: str
+    expires_at: datetime

cmsdials-2.3.0/cmsdials/auth/secret_key.py

@@ -0,0 +1,65 @@
+import warnings
+from typing import Optional
+
+from ._base import BaseCredentials
+from .client import AuthClient
+
+
+class Credentials(BaseCredentials):
+    """
+    Client secret key credentials.
+    These credentials use an application's client id and secret to provide
+    authorization to automation scripts.
+
+    With `client_id`, an api-access token is issued by CERN's Keycloak and sent
+    as a Bearer token, and a new one is issued before it expires. The
+    application must have been granted API access in DIALS.
+
+    Without `client_id`, the secret is sent in the X-CLIENT-SECRET header.
+    This is deprecated and will stop working once DIALS removes the header.
+    """
+
+    def __init__(
+        self,
+        token: Optional[str],
+        client_id: Optional[str] = None,
+        client: Optional[AuthClient] = None,
+    ) -> None:
+        if not token:
+            raise ValueError(
+                "token must be a non-empty Client secret key string"
+            )
+        super().__init__()
+        self.client_id = client_id
+        self.client_secret = token
+
+        if client_id is None:
+            warnings.warn(
+                "Credentials without client_id authenticate with the "
+                "X-CLIENT-SECRET header, which DIALS will stop accepting. "
+                "Pass the application's client_id as well.",
+                DeprecationWarning,
+                stacklevel=2,
+            )
+            self.token = token
+            return
+
+        self.client = client or AuthClient()
+        self.refresh()
+
+    def refresh(self) -> None:
+        if self.client_id is None:
+            return
+        api_token = self.client.api_access_token(
+            self.client_id, self.client_secret
+        )
+        self.token = api_token.access_token
+        self.token_type = api_token.token_type
+        self.expires_in = api_token.expires_in
+        self.expires_at = api_token.expires_at
+
+    def apply(self, headers: dict[str, str]) -> None:
+        if self.client_id is None:
+            headers["X-CLIENT-SECRET"] = self.token
+        else:
+            headers["Authorization"] = f"{self.token_type} {self.token}"

{cmsdials-2.1.0 → cmsdials-2.3.0}/cmsdials/clients/workspace/client.py

@@ -8,7 +8,7 @@ from ...utils.logger import logger
 
 class WorkspaceClient(BaseAPIClient):
     default_timeout = 30
-    lookup_url = "auth/"
+    lookup_url = "workspaces/"
 
     def __init__(
         self,
@@ -46,7 +46,7 @@ class WorkspaceClient(BaseAPIClient):
         return response.json()
 
     def list(self, retries=DEFAULT_RETRIES):
-        return self.__get("workspaces", retries=retries)
+        return self.__get("", retries=retries)
 
     def my_workspace(self, retries=DEFAULT_RETRIES):
-        return self.__get("user-default-workspace", retries=retries)
+        return self.__get("my-default/", retries=retries)