cmsdials 2.2.0__tar.gz → 2.4.0__tar.gz

{cmsdials-2.2.0 → cmsdials-2.4.0}/.gitlab-ci.yml

@@ -81,8 +81,8 @@ test_matrix:
         coverage_format: cobertura
         path: coverage.xml
   variables:
-    SECRET_KEY: "$SECRET_KEY"
-    # Application owning SECRET_KEY, enables the api-access token tests
+    CLIENT_SECRET: "$CLIENT_SECRET"
+    # Application owning CLIENT_SECRET, enables the api-access token tests
     CLIENT_ID: "cms-dials-dev-api-client-test"
   rules:
     - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'

{cmsdials-2.2.0 → cmsdials-2.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cmsdials
-Version: 2.2.0
+Version: 2.4.0
 Summary: The Python api client interface to DIALS service
 Author-email: Gabriel Moreira <gabriel.moreira@cern.ch>
 Project-URL: Repository, https://gitlab.cern.ch/cms-dqmdc/libraries/dials-py
@@ -53,21 +53,21 @@ Credentials are issued by CERN's Keycloak directly, dials-py never sends your pa
 ### Generating credentials with client secret
 
 ```python
-from cmsdials.auth.secret_key import Credentials
+from cmsdials.auth.client_credentials import Credentials
 
-creds = Credentials(client_id="my-application", token=".....")
+creds = Credentials(client_id="my-application", client_secret=".....")
 ```
 
 The token is renewed automatically before it expires.
 
-To get API access:
+To get API access (see [API access for applications](https://cms-ppd.docs.cern.ch/ts/software/DIALS/operations/api_access.html) for the details):
 
 1. Register an application in the [CERN Application Portal](https://application-portal.web.cern.ch) and enable "My application will need to get tokens using its own client ID and secret".
 2. Ask the DIALS team to grant API access to the application (it is added to the DIALS API access group).
 3. Use the application's client id and secret as shown above.
 
 > [!WARNING]
-> `Credentials(token=".....")` without `client_id` authenticates with the `X-CLIENT-SECRET` header, which is deprecated and emits a `DeprecationWarning`. DIALS will stop accepting it, so pass the `client_id` of your application.
+> `cmsdials.auth.secret_key.Credentials` is deprecated and emits a `DeprecationWarning`: it will be removed in dials-py 3.0.0. Replace `Credentials(client_id=..., token=...)` with `client_credentials.Credentials(client_id=..., client_secret=...)`. Without `client_id`, it authenticates with the `X-CLIENT-SECRET` header, which DIALS will stop accepting.
 
 ### Generating credentials with device
 
@@ -75,7 +75,7 @@ To get API access:
 
 ```python
 from cmsdials.auth.client import AuthClient
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 
 auth = AuthClient()
 token = auth.device_auth_flow()
@@ -87,15 +87,18 @@ creds = Credentials.from_authclient_token(token)
 Credentials are always cached once you authenticate at least one time, calling this method without having a cached credential file will automatically trigger the AuthClient device flow.
 
 ```python
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 
 creds = Credentials.from_creds_file()
 ```
 
+> [!WARNING]
+> `cmsdials.auth.bearer.Credentials` is deprecated and emits a `DeprecationWarning`: it will be removed in dials-py 3.0.0. Import `Credentials` from `cmsdials.auth.device` instead, it takes the same arguments.
+
 ### Basic Example
 
 ```python
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 from cmsdials import Dials
 from cmsdials.filters import LumisectionHistogram1DFilters
 
@@ -260,7 +263,7 @@ When listing and endpoint for a long time, you may loose connection or the serve
 
 ```python
 from cmsdials.auth.client import AuthClient
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 from cmsdials import Dials
 from cmsdials.filters import LumisectionHistogram2DFilters
 
@@ -319,7 +322,7 @@ The `AuthClient` issues tokens for the production DIALS applications by default.
 
 ```python
 from cmsdials.auth.client import AuthClient
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 from cmsdials import Dials
 from cmsdials.filters import LumisectionHistogram2DFilters
 
@@ -338,9 +341,9 @@ dials.h2d.list_all(LumisectionHistogram2DFilters(me__regex="EEOT digi occupancy
 When authenticating with a client secret, pass the same `AuthClient` so the token is issued for that instance:
 
 ```python
-from cmsdials.auth.secret_key import Credentials as SecretKeyCredentials
+from cmsdials.auth.client_credentials import Credentials as ClientCredentials
 
-creds = SecretKeyCredentials(client_id="my-application", token=".....", client=auth)
+creds = ClientCredentials(client_id="my-application", client_secret=".....", client=auth)
 dials = Dials(creds, base_url=DIALS_URL)
 ```
 
@@ -368,15 +371,15 @@ uv pip install -e .
 The repository has some tests written to make sure DIALS responses are compatible with pydantic metaclasses, you can use pytest to run all tests but you need to specify a secret key to authenticate non-interactively against DIALS api:
 
 ```bash
-SECRET_KEY=... uv run pytest tests
+CLIENT_SECRET=... uv run pytest tests
 ```
 
-The secret key is an api client enabled secret key and can be obtained from the applications portal, any api client secret key whitelisted in DIALS can be used. Set `CLIENT_ID` to the client id of the same application to test the api-access token flow (`SECRET_KEY=... CLIENT_ID=... uv run pytest tests`); otherwise those tests are skipped and the deprecated `X-CLIENT-SECRET` header is used. Tests target the dev Keycloak applications by default, overwrite them with `AUTH_CLIENT_ID` and `AUTH_AUDIENCE`. The interactive authentication flow should be tested manually, an example for this can be found in [test_auth_client.py](/tests/integration/test_auth_client.py).
+The secret key is an api client enabled secret key and can be obtained from the applications portal, any api client secret key whitelisted in DIALS can be used. Set `CLIENT_ID` to the client id of the same application to test the api-access token flow (`CLIENT_SECRET=... CLIENT_ID=... uv run pytest tests`); otherwise those tests are skipped and the deprecated `X-CLIENT-SECRET` header is used. Tests target the dev Keycloak applications by default, overwrite them with `AUTH_CLIENT_ID` and `AUTH_AUDIENCE`. The interactive authentication flow should be tested manually, an example for this can be found in [test_auth_client.py](/tests/integration/test_auth_client.py).
 
 If testing against a local version of DIALS you need to specify the BASE_URL:
 
 ```bash
-SECRET_KEY=... BASE_URL=http://localhost:8000 uv run pytest tests
+CLIENT_SECRET=... BASE_URL=http://localhost:8000 uv run pytest tests
 ```
 
 #### Tox
@@ -384,7 +387,7 @@ SECRET_KEY=... BASE_URL=http://localhost:8000 uv run pytest tests
 Tox is pre-configured in `tox.ini`, so you can run the following to test against multiple python versions locally:
 
 ```bash
-SECRET_KEY=... uv run tox
+CLIENT_SECRET=... uv run tox
 ```
 
 **[asdf](https://asdf-vm.com/) users**

{cmsdials-2.2.0 → cmsdials-2.4.0}/README.md

@@ -30,21 +30,21 @@ Credentials are issued by CERN's Keycloak directly, dials-py never sends your pa
 ### Generating credentials with client secret
 
 ```python
-from cmsdials.auth.secret_key import Credentials
+from cmsdials.auth.client_credentials import Credentials
 
-creds = Credentials(client_id="my-application", token=".....")
+creds = Credentials(client_id="my-application", client_secret=".....")
 ```
 
 The token is renewed automatically before it expires.
 
-To get API access:
+To get API access (see [API access for applications](https://cms-ppd.docs.cern.ch/ts/software/DIALS/operations/api_access.html) for the details):
 
 1. Register an application in the [CERN Application Portal](https://application-portal.web.cern.ch) and enable "My application will need to get tokens using its own client ID and secret".
 2. Ask the DIALS team to grant API access to the application (it is added to the DIALS API access group).
 3. Use the application's client id and secret as shown above.
 
 > [!WARNING]
-> `Credentials(token=".....")` without `client_id` authenticates with the `X-CLIENT-SECRET` header, which is deprecated and emits a `DeprecationWarning`. DIALS will stop accepting it, so pass the `client_id` of your application.
+> `cmsdials.auth.secret_key.Credentials` is deprecated and emits a `DeprecationWarning`: it will be removed in dials-py 3.0.0. Replace `Credentials(client_id=..., token=...)` with `client_credentials.Credentials(client_id=..., client_secret=...)`. Without `client_id`, it authenticates with the `X-CLIENT-SECRET` header, which DIALS will stop accepting.
 
 ### Generating credentials with device
 
@@ -52,7 +52,7 @@ To get API access:
 
 ```python
 from cmsdials.auth.client import AuthClient
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 
 auth = AuthClient()
 token = auth.device_auth_flow()
@@ -64,15 +64,18 @@ creds = Credentials.from_authclient_token(token)
 Credentials are always cached once you authenticate at least one time, calling this method without having a cached credential file will automatically trigger the AuthClient device flow.
 
 ```python
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 
 creds = Credentials.from_creds_file()
 ```
 
+> [!WARNING]
+> `cmsdials.auth.bearer.Credentials` is deprecated and emits a `DeprecationWarning`: it will be removed in dials-py 3.0.0. Import `Credentials` from `cmsdials.auth.device` instead, it takes the same arguments.
+
 ### Basic Example
 
 ```python
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 from cmsdials import Dials
 from cmsdials.filters import LumisectionHistogram1DFilters
 
@@ -237,7 +240,7 @@ When listing and endpoint for a long time, you may loose connection or the serve
 
 ```python
 from cmsdials.auth.client import AuthClient
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 from cmsdials import Dials
 from cmsdials.filters import LumisectionHistogram2DFilters
 
@@ -296,7 +299,7 @@ The `AuthClient` issues tokens for the production DIALS applications by default.
 
 ```python
 from cmsdials.auth.client import AuthClient
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 from cmsdials import Dials
 from cmsdials.filters import LumisectionHistogram2DFilters
 
@@ -315,9 +318,9 @@ dials.h2d.list_all(LumisectionHistogram2DFilters(me__regex="EEOT digi occupancy
 When authenticating with a client secret, pass the same `AuthClient` so the token is issued for that instance:
 
 ```python
-from cmsdials.auth.secret_key import Credentials as SecretKeyCredentials
+from cmsdials.auth.client_credentials import Credentials as ClientCredentials
 
-creds = SecretKeyCredentials(client_id="my-application", token=".....", client=auth)
+creds = ClientCredentials(client_id="my-application", client_secret=".....", client=auth)
 dials = Dials(creds, base_url=DIALS_URL)
 ```
 
@@ -345,15 +348,15 @@ uv pip install -e .
 The repository has some tests written to make sure DIALS responses are compatible with pydantic metaclasses, you can use pytest to run all tests but you need to specify a secret key to authenticate non-interactively against DIALS api:
 
 ```bash
-SECRET_KEY=... uv run pytest tests
+CLIENT_SECRET=... uv run pytest tests
 ```
 
-The secret key is an api client enabled secret key and can be obtained from the applications portal, any api client secret key whitelisted in DIALS can be used. Set `CLIENT_ID` to the client id of the same application to test the api-access token flow (`SECRET_KEY=... CLIENT_ID=... uv run pytest tests`); otherwise those tests are skipped and the deprecated `X-CLIENT-SECRET` header is used. Tests target the dev Keycloak applications by default, overwrite them with `AUTH_CLIENT_ID` and `AUTH_AUDIENCE`. The interactive authentication flow should be tested manually, an example for this can be found in [test_auth_client.py](/tests/integration/test_auth_client.py).
+The secret key is an api client enabled secret key and can be obtained from the applications portal, any api client secret key whitelisted in DIALS can be used. Set `CLIENT_ID` to the client id of the same application to test the api-access token flow (`CLIENT_SECRET=... CLIENT_ID=... uv run pytest tests`); otherwise those tests are skipped and the deprecated `X-CLIENT-SECRET` header is used. Tests target the dev Keycloak applications by default, overwrite them with `AUTH_CLIENT_ID` and `AUTH_AUDIENCE`. The interactive authentication flow should be tested manually, an example for this can be found in [test_auth_client.py](/tests/integration/test_auth_client.py).
 
 If testing against a local version of DIALS you need to specify the BASE_URL:
 
 ```bash
-SECRET_KEY=... BASE_URL=http://localhost:8000 uv run pytest tests
+CLIENT_SECRET=... BASE_URL=http://localhost:8000 uv run pytest tests
 ```
 
 #### Tox
@@ -361,7 +364,7 @@ SECRET_KEY=... BASE_URL=http://localhost:8000 uv run pytest tests
 Tox is pre-configured in `tox.ini`, so you can run the following to test against multiple python versions locally:
 
 ```bash
-SECRET_KEY=... uv run tox
+CLIENT_SECRET=... uv run tox
 ```
 
 **[asdf](https://asdf-vm.com/) users**

{cmsdials-2.2.0 → cmsdials-2.4.0}/cmsdials/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '2.2.0'
-__version_tuple__ = version_tuple = (2, 2, 0)
+__version__ = version = '2.4.0'
+__version_tuple__ = version_tuple = (2, 4, 0)
 
-__commit_id__ = commit_id = 'g395406611'
+__commit_id__ = commit_id = 'g9cd07880c'

cmsdials-2.4.0/cmsdials/auth/bearer.py

@@ -0,0 +1,62 @@
+import warnings
+from datetime import datetime
+from typing import Optional
+
+from .client import AuthClient
+from .device import Credentials as DeviceCredentials
+from .models import Token
+
+
+_DEPRECATION = (
+    "cmsdials.auth.bearer.Credentials is deprecated and will be removed in "
+    "dials-py 3.0.0, use cmsdials.auth.device.Credentials instead."
+)
+
+
+class Credentials(DeviceCredentials):
+    """
+    Deprecated, use `cmsdials.auth.device.Credentials`.
+    """
+
+    def __init__(
+        self,
+        token: str,
+        expires_at: datetime,
+        expires_in: int,
+        refresh_expires_at: datetime,
+        refresh_expires_in: int,
+        refresh_token: str,
+        token_type: str,
+        cache_dir: Optional[str] = None,
+        client: Optional[AuthClient] = None,
+    ):
+        warnings.warn(_DEPRECATION, DeprecationWarning, stacklevel=2)
+        super().__init__(
+            token=token,
+            expires_at=expires_at,
+            expires_in=expires_in,
+            refresh_expires_at=refresh_expires_at,
+            refresh_expires_in=refresh_expires_in,
+            refresh_token=refresh_token,
+            token_type=token_type,
+            cache_dir=cache_dir,
+            client=client,
+        )
+
+    @staticmethod
+    def from_authclient_token(
+        token: Token,
+        cache_dir: Optional[str] = None,
+        client: Optional[AuthClient] = None,
+    ) -> DeviceCredentials:
+        warnings.warn(_DEPRECATION, DeprecationWarning, stacklevel=2)
+        return DeviceCredentials.from_authclient_token(
+            token, cache_dir, client
+        )
+
+    @staticmethod
+    def from_creds_file(
+        cache_dir: Optional[str] = None, client: Optional[AuthClient] = None
+    ) -> DeviceCredentials:
+        warnings.warn(_DEPRECATION, DeprecationWarning, stacklevel=2)
+        return DeviceCredentials.from_creds_file(cache_dir, client)

{cmsdials-2.2.0 → cmsdials-2.4.0}/cmsdials/auth/client.py

@@ -1,4 +1,5 @@
 import time
+import warnings
 from datetime import datetime, timedelta
 from typing import Optional
 
@@ -47,6 +48,23 @@ class AuthClient(BaseAPIClient):
         audience: Optional[str] = None,
         **kwargs,
     ) -> None:
+        # Leftovers from releases that logged in through DIALS: tokens are now
+        # issued by Keycloak, and the instance is selected by client_id and
+        # audience, so these would silently target production.
+        ignored = [
+            name
+            for name in ("base_url", "route", "version")
+            if kwargs.get(name) is not None
+        ]
+        if args or ignored:
+            warnings.warn(
+                "AuthClient ignores base_url, route and version, which will "
+                "raise TypeError in dials-py 3.0.0. Tokens are issued by CERN "
+                "Keycloak: to target another DIALS instance, pass its "
+                "client_id and audience instead.",
+                DeprecationWarning,
+                stacklevel=2,
+            )
         super().__init__(*args, **kwargs)
         keycloak_url = keycloak_url or self.PRODUCTION_KEYCLOAK_URL
         if not keycloak_url.endswith("/"):

cmsdials-2.4.0/cmsdials/auth/client_credentials.py

@@ -0,0 +1,48 @@
+from typing import Optional
+
+from ._base import BaseCredentials
+from .client import AuthClient
+
+
+class Credentials(BaseCredentials):
+    """
+    Client credentials.
+    These credentials use an application's client id and secret to provide
+    authorization to automation scripts.
+
+    An api-access token is issued by CERN's Keycloak and sent as a Bearer
+    token, and a new one is issued before it expires. The application must
+    have been granted API access in DIALS.
+    """
+
+    def __init__(
+        self,
+        client_id: str,
+        client_secret: str,
+        client: Optional[AuthClient] = None,
+    ) -> None:
+        if not client_id:
+            raise ValueError(
+                "client_id must be the non-empty client id of the application"
+            )
+        if not client_secret:
+            raise ValueError(
+                "client_secret must be the non-empty client secret of the application"
+            )
+        super().__init__()
+        self.client_id = client_id
+        self.client_secret = client_secret
+        self.client = client or AuthClient()
+        self.refresh()
+
+    def refresh(self) -> None:
+        api_token = self.client.api_access_token(
+            self.client_id, self.client_secret
+        )
+        self.token = api_token.access_token
+        self.token_type = api_token.token_type
+        self.expires_in = api_token.expires_in
+        self.expires_at = api_token.expires_at
+
+    def apply(self, headers: dict[str, str]) -> None:
+        headers["Authorization"] = f"{self.token_type} {self.token}"

cmsdials-2.2.0/cmsdials/auth/bearer.py → cmsdials-2.4.0/cmsdials/auth/device.py

@@ -19,8 +19,11 @@ DEFAULT_CACHE_FILENAME = "creds"
 
 class Credentials(BaseCredentials):
     """
-    Token credentials.
-    These credential use a token to provide authorization to applications.
+    Device credentials.
+    These credentials authenticate a person with the device authorization
+    grant on CERN's Keycloak, and renew the token with its refresh token.
+    Tokens are cached in a file, and the device flow is triggered again
+    when they can no longer be renewed.
     """
 
     def __init__(
@@ -170,6 +173,6 @@ class Credentials(BaseCredentials):
 
     def apply(self, headers: dict[str, str]) -> None:
         """
-        Apply the Client secret key token to the X-CLIENT-SECRET header.
+        Apply the access token to the Authorization header.
         """
         headers["Authorization"] = f"{self.token_type} {self.token}"

cmsdials-2.4.0/cmsdials/auth/secret_key.py

@@ -0,0 +1,68 @@
+import warnings
+from typing import Optional
+
+from ._base import BaseCredentials
+from .client import AuthClient
+from .client_credentials import Credentials as ClientCredentials
+
+
+class Credentials(ClientCredentials):
+    """
+    Deprecated, use `cmsdials.auth.client_credentials.Credentials`.
+
+    With `client_id`, it behaves as client credentials, with `token` as the
+    client secret.
+
+    Without `client_id`, the secret is sent in the X-CLIENT-SECRET header.
+    This will stop working once DIALS removes the header.
+    """
+
+    def __init__(
+        self,
+        token: Optional[str],
+        client_id: Optional[str] = None,
+        client: Optional[AuthClient] = None,
+    ) -> None:
+        if not token:
+            raise ValueError(
+                "token must be a non-empty Client secret key string"
+            )
+
+        replacement = (
+            "use cmsdials.auth.client_credentials.Credentials("
+            "client_id=..., client_secret=...) instead."
+        )
+        self.legacy_header = client_id is None
+        if client_id is None:
+            warnings.warn(
+                "Credentials without client_id authenticate with the "
+                "X-CLIENT-SECRET header, which DIALS will stop accepting, "
+                + replacement,
+                DeprecationWarning,
+                stacklevel=2,
+            )
+            BaseCredentials.__init__(self)
+            self.client_secret = token
+            self.token = token
+            return
+
+        warnings.warn(
+            "cmsdials.auth.secret_key.Credentials is deprecated and will be "
+            "removed in dials-py 3.0.0, " + replacement,
+            DeprecationWarning,
+            stacklevel=2,
+        )
+        super().__init__(
+            client_id=client_id, client_secret=token, client=client
+        )
+
+    def refresh(self) -> None:
+        if self.legacy_header:
+            return
+        super().refresh()
+
+    def apply(self, headers: dict[str, str]) -> None:
+        if self.legacy_header:
+            headers["X-CLIENT-SECRET"] = self.token
+        else:
+            super().apply(headers)

{cmsdials-2.2.0 → cmsdials-2.4.0}/cmsdials/clients/workspace/client.py

@@ -8,7 +8,7 @@ from ...utils.logger import logger
 
 class WorkspaceClient(BaseAPIClient):
     default_timeout = 30
-    lookup_url = "auth/"
+    lookup_url = "workspaces/"
 
     def __init__(
         self,
@@ -46,7 +46,7 @@ class WorkspaceClient(BaseAPIClient):
         return response.json()
 
     def list(self, retries=DEFAULT_RETRIES):
-        return self.__get("workspaces", retries=retries)
+        return self.__get("", retries=retries)
 
     def my_workspace(self, retries=DEFAULT_RETRIES):
-        return self.__get("user-default-workspace", retries=retries)
+        return self.__get("my-default/", retries=retries)

{cmsdials-2.2.0 → cmsdials-2.4.0}/cmsdials.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cmsdials
-Version: 2.2.0
+Version: 2.4.0
 Summary: The Python api client interface to DIALS service
 Author-email: Gabriel Moreira <gabriel.moreira@cern.ch>
 Project-URL: Repository, https://gitlab.cern.ch/cms-dqmdc/libraries/dials-py
@@ -53,21 +53,21 @@ Credentials are issued by CERN's Keycloak directly, dials-py never sends your pa
 ### Generating credentials with client secret
 
 ```python
-from cmsdials.auth.secret_key import Credentials
+from cmsdials.auth.client_credentials import Credentials
 
-creds = Credentials(client_id="my-application", token=".....")
+creds = Credentials(client_id="my-application", client_secret=".....")
 ```
 
 The token is renewed automatically before it expires.
 
-To get API access:
+To get API access (see [API access for applications](https://cms-ppd.docs.cern.ch/ts/software/DIALS/operations/api_access.html) for the details):
 
 1. Register an application in the [CERN Application Portal](https://application-portal.web.cern.ch) and enable "My application will need to get tokens using its own client ID and secret".
 2. Ask the DIALS team to grant API access to the application (it is added to the DIALS API access group).
 3. Use the application's client id and secret as shown above.
 
 > [!WARNING]
-> `Credentials(token=".....")` without `client_id` authenticates with the `X-CLIENT-SECRET` header, which is deprecated and emits a `DeprecationWarning`. DIALS will stop accepting it, so pass the `client_id` of your application.
+> `cmsdials.auth.secret_key.Credentials` is deprecated and emits a `DeprecationWarning`: it will be removed in dials-py 3.0.0. Replace `Credentials(client_id=..., token=...)` with `client_credentials.Credentials(client_id=..., client_secret=...)`. Without `client_id`, it authenticates with the `X-CLIENT-SECRET` header, which DIALS will stop accepting.
 
 ### Generating credentials with device
 
@@ -75,7 +75,7 @@ To get API access:
 
 ```python
 from cmsdials.auth.client import AuthClient
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 
 auth = AuthClient()
 token = auth.device_auth_flow()
@@ -87,15 +87,18 @@ creds = Credentials.from_authclient_token(token)
 Credentials are always cached once you authenticate at least one time, calling this method without having a cached credential file will automatically trigger the AuthClient device flow.
 
 ```python
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 
 creds = Credentials.from_creds_file()
 ```
 
+> [!WARNING]
+> `cmsdials.auth.bearer.Credentials` is deprecated and emits a `DeprecationWarning`: it will be removed in dials-py 3.0.0. Import `Credentials` from `cmsdials.auth.device` instead, it takes the same arguments.
+
 ### Basic Example
 
 ```python
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 from cmsdials import Dials
 from cmsdials.filters import LumisectionHistogram1DFilters
 
@@ -260,7 +263,7 @@ When listing and endpoint for a long time, you may loose connection or the serve
 
 ```python
 from cmsdials.auth.client import AuthClient
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 from cmsdials import Dials
 from cmsdials.filters import LumisectionHistogram2DFilters
 
@@ -319,7 +322,7 @@ The `AuthClient` issues tokens for the production DIALS applications by default.
 
 ```python
 from cmsdials.auth.client import AuthClient
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 from cmsdials import Dials
 from cmsdials.filters import LumisectionHistogram2DFilters
 
@@ -338,9 +341,9 @@ dials.h2d.list_all(LumisectionHistogram2DFilters(me__regex="EEOT digi occupancy
 When authenticating with a client secret, pass the same `AuthClient` so the token is issued for that instance:
 
 ```python
-from cmsdials.auth.secret_key import Credentials as SecretKeyCredentials
+from cmsdials.auth.client_credentials import Credentials as ClientCredentials
 
-creds = SecretKeyCredentials(client_id="my-application", token=".....", client=auth)
+creds = ClientCredentials(client_id="my-application", client_secret=".....", client=auth)
 dials = Dials(creds, base_url=DIALS_URL)
 ```
 
@@ -368,15 +371,15 @@ uv pip install -e .
 The repository has some tests written to make sure DIALS responses are compatible with pydantic metaclasses, you can use pytest to run all tests but you need to specify a secret key to authenticate non-interactively against DIALS api:
 
 ```bash
-SECRET_KEY=... uv run pytest tests
+CLIENT_SECRET=... uv run pytest tests
 ```
 
-The secret key is an api client enabled secret key and can be obtained from the applications portal, any api client secret key whitelisted in DIALS can be used. Set `CLIENT_ID` to the client id of the same application to test the api-access token flow (`SECRET_KEY=... CLIENT_ID=... uv run pytest tests`); otherwise those tests are skipped and the deprecated `X-CLIENT-SECRET` header is used. Tests target the dev Keycloak applications by default, overwrite them with `AUTH_CLIENT_ID` and `AUTH_AUDIENCE`. The interactive authentication flow should be tested manually, an example for this can be found in [test_auth_client.py](/tests/integration/test_auth_client.py).
+The secret key is an api client enabled secret key and can be obtained from the applications portal, any api client secret key whitelisted in DIALS can be used. Set `CLIENT_ID` to the client id of the same application to test the api-access token flow (`CLIENT_SECRET=... CLIENT_ID=... uv run pytest tests`); otherwise those tests are skipped and the deprecated `X-CLIENT-SECRET` header is used. Tests target the dev Keycloak applications by default, overwrite them with `AUTH_CLIENT_ID` and `AUTH_AUDIENCE`. The interactive authentication flow should be tested manually, an example for this can be found in [test_auth_client.py](/tests/integration/test_auth_client.py).
 
 If testing against a local version of DIALS you need to specify the BASE_URL:
 
 ```bash
-SECRET_KEY=... BASE_URL=http://localhost:8000 uv run pytest tests
+CLIENT_SECRET=... BASE_URL=http://localhost:8000 uv run pytest tests
 ```
 
 #### Tox
@@ -384,7 +387,7 @@ SECRET_KEY=... BASE_URL=http://localhost:8000 uv run pytest tests
 Tox is pre-configured in `tox.ini`, so you can run the following to test against multiple python versions locally:
 
 ```bash
-SECRET_KEY=... uv run tox
+CLIENT_SECRET=... uv run tox
 ```
 
 **[asdf](https://asdf-vm.com/) users**

{cmsdials-2.2.0 → cmsdials-2.4.0}/cmsdials.egg-info/SOURCES.txt

@@ -28,6 +28,8 @@ cmsdials/auth/__init__.py
 cmsdials/auth/_base.py
 cmsdials/auth/bearer.py
 cmsdials/auth/client.py
+cmsdials/auth/client_credentials.py
+cmsdials/auth/device.py
 cmsdials/auth/exceptions.py
 cmsdials/auth/models.py
 cmsdials/auth/secret_key.py

{cmsdials-2.2.0 → cmsdials-2.4.0}/cmsdials.egg-info/scm_file_list.json

@@ -14,6 +14,8 @@
     "cmsdials/auth/_base.py",
     "cmsdials/auth/bearer.py",
     "cmsdials/auth/client.py",
+    "cmsdials/auth/client_credentials.py",
+    "cmsdials/auth/device.py",
     "cmsdials/auth/exceptions.py",
     "cmsdials/auth/models.py",
     "cmsdials/auth/secret_key.py",

cmsdials-2.4.0/cmsdials.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "2.4.0",
+  "distance": 0,
+  "node": "g9cd07880ca4c733ad91f8794d91a5d384be58fbf",
+  "dirty": false,
+  "branch": "HEAD",
+  "node_date": "2026-10-21"
+}