cmsdials 2.3.0__tar.gz → 2.4.0__tar.gz

{cmsdials-2.3.0 → cmsdials-2.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cmsdials
-Version: 2.3.0
+Version: 2.4.0
 Summary: The Python api client interface to DIALS service
 Author-email: Gabriel Moreira <gabriel.moreira@cern.ch>
 Project-URL: Repository, https://gitlab.cern.ch/cms-dqmdc/libraries/dials-py
@@ -53,21 +53,21 @@ Credentials are issued by CERN's Keycloak directly, dials-py never sends your pa
 ### Generating credentials with client secret
 
 ```python
-from cmsdials.auth.secret_key import Credentials
+from cmsdials.auth.client_credentials import Credentials
 
-creds = Credentials(client_id="my-application", token=".....")
+creds = Credentials(client_id="my-application", client_secret=".....")
 ```
 
 The token is renewed automatically before it expires.
 
-To get API access:
+To get API access (see [API access for applications](https://cms-ppd.docs.cern.ch/ts/software/DIALS/operations/api_access.html) for the details):
 
 1. Register an application in the [CERN Application Portal](https://application-portal.web.cern.ch) and enable "My application will need to get tokens using its own client ID and secret".
 2. Ask the DIALS team to grant API access to the application (it is added to the DIALS API access group).
 3. Use the application's client id and secret as shown above.
 
 > [!WARNING]
-> `Credentials(token=".....")` without `client_id` authenticates with the `X-CLIENT-SECRET` header, which is deprecated and emits a `DeprecationWarning`. DIALS will stop accepting it, so pass the `client_id` of your application.
+> `cmsdials.auth.secret_key.Credentials` is deprecated and emits a `DeprecationWarning`: it will be removed in dials-py 3.0.0. Replace `Credentials(client_id=..., token=...)` with `client_credentials.Credentials(client_id=..., client_secret=...)`. Without `client_id`, it authenticates with the `X-CLIENT-SECRET` header, which DIALS will stop accepting.
 
 ### Generating credentials with device
 
@@ -75,7 +75,7 @@ To get API access:
 
 ```python
 from cmsdials.auth.client import AuthClient
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 
 auth = AuthClient()
 token = auth.device_auth_flow()
@@ -87,15 +87,18 @@ creds = Credentials.from_authclient_token(token)
 Credentials are always cached once you authenticate at least one time, calling this method without having a cached credential file will automatically trigger the AuthClient device flow.
 
 ```python
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 
 creds = Credentials.from_creds_file()
 ```
 
+> [!WARNING]
+> `cmsdials.auth.bearer.Credentials` is deprecated and emits a `DeprecationWarning`: it will be removed in dials-py 3.0.0. Import `Credentials` from `cmsdials.auth.device` instead, it takes the same arguments.
+
 ### Basic Example
 
 ```python
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 from cmsdials import Dials
 from cmsdials.filters import LumisectionHistogram1DFilters
 
@@ -260,7 +263,7 @@ When listing and endpoint for a long time, you may loose connection or the serve
 
 ```python
 from cmsdials.auth.client import AuthClient
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 from cmsdials import Dials
 from cmsdials.filters import LumisectionHistogram2DFilters
 
@@ -319,7 +322,7 @@ The `AuthClient` issues tokens for the production DIALS applications by default.
 
 ```python
 from cmsdials.auth.client import AuthClient
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 from cmsdials import Dials
 from cmsdials.filters import LumisectionHistogram2DFilters
 
@@ -338,9 +341,9 @@ dials.h2d.list_all(LumisectionHistogram2DFilters(me__regex="EEOT digi occupancy
 When authenticating with a client secret, pass the same `AuthClient` so the token is issued for that instance:
 
 ```python
-from cmsdials.auth.secret_key import Credentials as SecretKeyCredentials
+from cmsdials.auth.client_credentials import Credentials as ClientCredentials
 
-creds = SecretKeyCredentials(client_id="my-application", token=".....", client=auth)
+creds = ClientCredentials(client_id="my-application", client_secret=".....", client=auth)
 dials = Dials(creds, base_url=DIALS_URL)
 ```
 

{cmsdials-2.3.0 → cmsdials-2.4.0}/README.md

@@ -30,21 +30,21 @@ Credentials are issued by CERN's Keycloak directly, dials-py never sends your pa
 ### Generating credentials with client secret
 
 ```python
-from cmsdials.auth.secret_key import Credentials
+from cmsdials.auth.client_credentials import Credentials
 
-creds = Credentials(client_id="my-application", token=".....")
+creds = Credentials(client_id="my-application", client_secret=".....")
 ```
 
 The token is renewed automatically before it expires.
 
-To get API access:
+To get API access (see [API access for applications](https://cms-ppd.docs.cern.ch/ts/software/DIALS/operations/api_access.html) for the details):
 
 1. Register an application in the [CERN Application Portal](https://application-portal.web.cern.ch) and enable "My application will need to get tokens using its own client ID and secret".
 2. Ask the DIALS team to grant API access to the application (it is added to the DIALS API access group).
 3. Use the application's client id and secret as shown above.
 
 > [!WARNING]
-> `Credentials(token=".....")` without `client_id` authenticates with the `X-CLIENT-SECRET` header, which is deprecated and emits a `DeprecationWarning`. DIALS will stop accepting it, so pass the `client_id` of your application.
+> `cmsdials.auth.secret_key.Credentials` is deprecated and emits a `DeprecationWarning`: it will be removed in dials-py 3.0.0. Replace `Credentials(client_id=..., token=...)` with `client_credentials.Credentials(client_id=..., client_secret=...)`. Without `client_id`, it authenticates with the `X-CLIENT-SECRET` header, which DIALS will stop accepting.
 
 ### Generating credentials with device
 
@@ -52,7 +52,7 @@ To get API access:
 
 ```python
 from cmsdials.auth.client import AuthClient
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 
 auth = AuthClient()
 token = auth.device_auth_flow()
@@ -64,15 +64,18 @@ creds = Credentials.from_authclient_token(token)
 Credentials are always cached once you authenticate at least one time, calling this method without having a cached credential file will automatically trigger the AuthClient device flow.
 
 ```python
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 
 creds = Credentials.from_creds_file()
 ```
 
+> [!WARNING]
+> `cmsdials.auth.bearer.Credentials` is deprecated and emits a `DeprecationWarning`: it will be removed in dials-py 3.0.0. Import `Credentials` from `cmsdials.auth.device` instead, it takes the same arguments.
+
 ### Basic Example
 
 ```python
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 from cmsdials import Dials
 from cmsdials.filters import LumisectionHistogram1DFilters
 
@@ -237,7 +240,7 @@ When listing and endpoint for a long time, you may loose connection or the serve
 
 ```python
 from cmsdials.auth.client import AuthClient
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 from cmsdials import Dials
 from cmsdials.filters import LumisectionHistogram2DFilters
 
@@ -296,7 +299,7 @@ The `AuthClient` issues tokens for the production DIALS applications by default.
 
 ```python
 from cmsdials.auth.client import AuthClient
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 from cmsdials import Dials
 from cmsdials.filters import LumisectionHistogram2DFilters
 
@@ -315,9 +318,9 @@ dials.h2d.list_all(LumisectionHistogram2DFilters(me__regex="EEOT digi occupancy
 When authenticating with a client secret, pass the same `AuthClient` so the token is issued for that instance:
 
 ```python
-from cmsdials.auth.secret_key import Credentials as SecretKeyCredentials
+from cmsdials.auth.client_credentials import Credentials as ClientCredentials
 
-creds = SecretKeyCredentials(client_id="my-application", token=".....", client=auth)
+creds = ClientCredentials(client_id="my-application", client_secret=".....", client=auth)
 dials = Dials(creds, base_url=DIALS_URL)
 ```
 

{cmsdials-2.3.0 → cmsdials-2.4.0}/cmsdials/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '2.3.0'
-__version_tuple__ = version_tuple = (2, 3, 0)
+__version__ = version = '2.4.0'
+__version_tuple__ = version_tuple = (2, 4, 0)
 
-__commit_id__ = commit_id = 'g044d28ceb'
+__commit_id__ = commit_id = 'g9cd07880c'

cmsdials-2.4.0/cmsdials/auth/bearer.py

@@ -0,0 +1,62 @@
+import warnings
+from datetime import datetime
+from typing import Optional
+
+from .client import AuthClient
+from .device import Credentials as DeviceCredentials
+from .models import Token
+
+
+_DEPRECATION = (
+    "cmsdials.auth.bearer.Credentials is deprecated and will be removed in "
+    "dials-py 3.0.0, use cmsdials.auth.device.Credentials instead."
+)
+
+
+class Credentials(DeviceCredentials):
+    """
+    Deprecated, use `cmsdials.auth.device.Credentials`.
+    """
+
+    def __init__(
+        self,
+        token: str,
+        expires_at: datetime,
+        expires_in: int,
+        refresh_expires_at: datetime,
+        refresh_expires_in: int,
+        refresh_token: str,
+        token_type: str,
+        cache_dir: Optional[str] = None,
+        client: Optional[AuthClient] = None,
+    ):
+        warnings.warn(_DEPRECATION, DeprecationWarning, stacklevel=2)
+        super().__init__(
+            token=token,
+            expires_at=expires_at,
+            expires_in=expires_in,
+            refresh_expires_at=refresh_expires_at,
+            refresh_expires_in=refresh_expires_in,
+            refresh_token=refresh_token,
+            token_type=token_type,
+            cache_dir=cache_dir,
+            client=client,
+        )
+
+    @staticmethod
+    def from_authclient_token(
+        token: Token,
+        cache_dir: Optional[str] = None,
+        client: Optional[AuthClient] = None,
+    ) -> DeviceCredentials:
+        warnings.warn(_DEPRECATION, DeprecationWarning, stacklevel=2)
+        return DeviceCredentials.from_authclient_token(
+            token, cache_dir, client
+        )
+
+    @staticmethod
+    def from_creds_file(
+        cache_dir: Optional[str] = None, client: Optional[AuthClient] = None
+    ) -> DeviceCredentials:
+        warnings.warn(_DEPRECATION, DeprecationWarning, stacklevel=2)
+        return DeviceCredentials.from_creds_file(cache_dir, client)

{cmsdials-2.3.0 → cmsdials-2.4.0}/cmsdials/auth/client.py

@@ -1,4 +1,5 @@
 import time
+import warnings
 from datetime import datetime, timedelta
 from typing import Optional
 
@@ -47,6 +48,23 @@ class AuthClient(BaseAPIClient):
         audience: Optional[str] = None,
         **kwargs,
     ) -> None:
+        # Leftovers from releases that logged in through DIALS: tokens are now
+        # issued by Keycloak, and the instance is selected by client_id and
+        # audience, so these would silently target production.
+        ignored = [
+            name
+            for name in ("base_url", "route", "version")
+            if kwargs.get(name) is not None
+        ]
+        if args or ignored:
+            warnings.warn(
+                "AuthClient ignores base_url, route and version, which will "
+                "raise TypeError in dials-py 3.0.0. Tokens are issued by CERN "
+                "Keycloak: to target another DIALS instance, pass its "
+                "client_id and audience instead.",
+                DeprecationWarning,
+                stacklevel=2,
+            )
         super().__init__(*args, **kwargs)
         keycloak_url = keycloak_url or self.PRODUCTION_KEYCLOAK_URL
         if not keycloak_url.endswith("/"):

cmsdials-2.4.0/cmsdials/auth/client_credentials.py

@@ -0,0 +1,48 @@
+from typing import Optional
+
+from ._base import BaseCredentials
+from .client import AuthClient
+
+
+class Credentials(BaseCredentials):
+    """
+    Client credentials.
+    These credentials use an application's client id and secret to provide
+    authorization to automation scripts.
+
+    An api-access token is issued by CERN's Keycloak and sent as a Bearer
+    token, and a new one is issued before it expires. The application must
+    have been granted API access in DIALS.
+    """
+
+    def __init__(
+        self,
+        client_id: str,
+        client_secret: str,
+        client: Optional[AuthClient] = None,
+    ) -> None:
+        if not client_id:
+            raise ValueError(
+                "client_id must be the non-empty client id of the application"
+            )
+        if not client_secret:
+            raise ValueError(
+                "client_secret must be the non-empty client secret of the application"
+            )
+        super().__init__()
+        self.client_id = client_id
+        self.client_secret = client_secret
+        self.client = client or AuthClient()
+        self.refresh()
+
+    def refresh(self) -> None:
+        api_token = self.client.api_access_token(
+            self.client_id, self.client_secret
+        )
+        self.token = api_token.access_token
+        self.token_type = api_token.token_type
+        self.expires_in = api_token.expires_in
+        self.expires_at = api_token.expires_at
+
+    def apply(self, headers: dict[str, str]) -> None:
+        headers["Authorization"] = f"{self.token_type} {self.token}"

cmsdials-2.3.0/cmsdials/auth/bearer.py → cmsdials-2.4.0/cmsdials/auth/device.py

@@ -19,8 +19,11 @@ DEFAULT_CACHE_FILENAME = "creds"
 
 class Credentials(BaseCredentials):
     """
-    Token credentials.
-    These credential use a token to provide authorization to applications.
+    Device credentials.
+    These credentials authenticate a person with the device authorization
+    grant on CERN's Keycloak, and renew the token with its refresh token.
+    Tokens are cached in a file, and the device flow is triggered again
+    when they can no longer be renewed.
     """
 
     def __init__(
@@ -170,6 +173,6 @@ class Credentials(BaseCredentials):
 
     def apply(self, headers: dict[str, str]) -> None:
         """
-        Apply the Client secret key token to the X-CLIENT-SECRET header.
+        Apply the access token to the Authorization header.
         """
         headers["Authorization"] = f"{self.token_type} {self.token}"

cmsdials-2.4.0/cmsdials/auth/secret_key.py

@@ -0,0 +1,68 @@
+import warnings
+from typing import Optional
+
+from ._base import BaseCredentials
+from .client import AuthClient
+from .client_credentials import Credentials as ClientCredentials
+
+
+class Credentials(ClientCredentials):
+    """
+    Deprecated, use `cmsdials.auth.client_credentials.Credentials`.
+
+    With `client_id`, it behaves as client credentials, with `token` as the
+    client secret.
+
+    Without `client_id`, the secret is sent in the X-CLIENT-SECRET header.
+    This will stop working once DIALS removes the header.
+    """
+
+    def __init__(
+        self,
+        token: Optional[str],
+        client_id: Optional[str] = None,
+        client: Optional[AuthClient] = None,
+    ) -> None:
+        if not token:
+            raise ValueError(
+                "token must be a non-empty Client secret key string"
+            )
+
+        replacement = (
+            "use cmsdials.auth.client_credentials.Credentials("
+            "client_id=..., client_secret=...) instead."
+        )
+        self.legacy_header = client_id is None
+        if client_id is None:
+            warnings.warn(
+                "Credentials without client_id authenticate with the "
+                "X-CLIENT-SECRET header, which DIALS will stop accepting, "
+                + replacement,
+                DeprecationWarning,
+                stacklevel=2,
+            )
+            BaseCredentials.__init__(self)
+            self.client_secret = token
+            self.token = token
+            return
+
+        warnings.warn(
+            "cmsdials.auth.secret_key.Credentials is deprecated and will be "
+            "removed in dials-py 3.0.0, " + replacement,
+            DeprecationWarning,
+            stacklevel=2,
+        )
+        super().__init__(
+            client_id=client_id, client_secret=token, client=client
+        )
+
+    def refresh(self) -> None:
+        if self.legacy_header:
+            return
+        super().refresh()
+
+    def apply(self, headers: dict[str, str]) -> None:
+        if self.legacy_header:
+            headers["X-CLIENT-SECRET"] = self.token
+        else:
+            super().apply(headers)

{cmsdials-2.3.0 → cmsdials-2.4.0}/cmsdials.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cmsdials
-Version: 2.3.0
+Version: 2.4.0
 Summary: The Python api client interface to DIALS service
 Author-email: Gabriel Moreira <gabriel.moreira@cern.ch>
 Project-URL: Repository, https://gitlab.cern.ch/cms-dqmdc/libraries/dials-py
@@ -53,21 +53,21 @@ Credentials are issued by CERN's Keycloak directly, dials-py never sends your pa
 ### Generating credentials with client secret
 
 ```python
-from cmsdials.auth.secret_key import Credentials
+from cmsdials.auth.client_credentials import Credentials
 
-creds = Credentials(client_id="my-application", token=".....")
+creds = Credentials(client_id="my-application", client_secret=".....")
 ```
 
 The token is renewed automatically before it expires.
 
-To get API access:
+To get API access (see [API access for applications](https://cms-ppd.docs.cern.ch/ts/software/DIALS/operations/api_access.html) for the details):
 
 1. Register an application in the [CERN Application Portal](https://application-portal.web.cern.ch) and enable "My application will need to get tokens using its own client ID and secret".
 2. Ask the DIALS team to grant API access to the application (it is added to the DIALS API access group).
 3. Use the application's client id and secret as shown above.
 
 > [!WARNING]
-> `Credentials(token=".....")` without `client_id` authenticates with the `X-CLIENT-SECRET` header, which is deprecated and emits a `DeprecationWarning`. DIALS will stop accepting it, so pass the `client_id` of your application.
+> `cmsdials.auth.secret_key.Credentials` is deprecated and emits a `DeprecationWarning`: it will be removed in dials-py 3.0.0. Replace `Credentials(client_id=..., token=...)` with `client_credentials.Credentials(client_id=..., client_secret=...)`. Without `client_id`, it authenticates with the `X-CLIENT-SECRET` header, which DIALS will stop accepting.
 
 ### Generating credentials with device
 
@@ -75,7 +75,7 @@ To get API access:
 
 ```python
 from cmsdials.auth.client import AuthClient
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 
 auth = AuthClient()
 token = auth.device_auth_flow()
@@ -87,15 +87,18 @@ creds = Credentials.from_authclient_token(token)
 Credentials are always cached once you authenticate at least one time, calling this method without having a cached credential file will automatically trigger the AuthClient device flow.
 
 ```python
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 
 creds = Credentials.from_creds_file()
 ```
 
+> [!WARNING]
+> `cmsdials.auth.bearer.Credentials` is deprecated and emits a `DeprecationWarning`: it will be removed in dials-py 3.0.0. Import `Credentials` from `cmsdials.auth.device` instead, it takes the same arguments.
+
 ### Basic Example
 
 ```python
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 from cmsdials import Dials
 from cmsdials.filters import LumisectionHistogram1DFilters
 
@@ -260,7 +263,7 @@ When listing and endpoint for a long time, you may loose connection or the serve
 
 ```python
 from cmsdials.auth.client import AuthClient
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 from cmsdials import Dials
 from cmsdials.filters import LumisectionHistogram2DFilters
 
@@ -319,7 +322,7 @@ The `AuthClient` issues tokens for the production DIALS applications by default.
 
 ```python
 from cmsdials.auth.client import AuthClient
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 from cmsdials import Dials
 from cmsdials.filters import LumisectionHistogram2DFilters
 
@@ -338,9 +341,9 @@ dials.h2d.list_all(LumisectionHistogram2DFilters(me__regex="EEOT digi occupancy
 When authenticating with a client secret, pass the same `AuthClient` so the token is issued for that instance:
 
 ```python
-from cmsdials.auth.secret_key import Credentials as SecretKeyCredentials
+from cmsdials.auth.client_credentials import Credentials as ClientCredentials
 
-creds = SecretKeyCredentials(client_id="my-application", token=".....", client=auth)
+creds = ClientCredentials(client_id="my-application", client_secret=".....", client=auth)
 dials = Dials(creds, base_url=DIALS_URL)
 ```
 

{cmsdials-2.3.0 → cmsdials-2.4.0}/cmsdials.egg-info/SOURCES.txt

@@ -28,6 +28,8 @@ cmsdials/auth/__init__.py
 cmsdials/auth/_base.py
 cmsdials/auth/bearer.py
 cmsdials/auth/client.py
+cmsdials/auth/client_credentials.py
+cmsdials/auth/device.py
 cmsdials/auth/exceptions.py
 cmsdials/auth/models.py
 cmsdials/auth/secret_key.py

{cmsdials-2.3.0 → cmsdials-2.4.0}/cmsdials.egg-info/scm_file_list.json

@@ -14,6 +14,8 @@
     "cmsdials/auth/_base.py",
     "cmsdials/auth/bearer.py",
     "cmsdials/auth/client.py",
+    "cmsdials/auth/client_credentials.py",
+    "cmsdials/auth/device.py",
     "cmsdials/auth/exceptions.py",
     "cmsdials/auth/models.py",
     "cmsdials/auth/secret_key.py",

{cmsdials-2.3.0 → cmsdials-2.4.0}/cmsdials.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "2.3.0",
+  "tag": "2.4.0",
   "distance": 0,
-  "node": "g044d28ceb686efd620bbbb7c6a4d87fbda5d076c",
+  "node": "g9cd07880ca4c733ad91f8794d91a5d384be58fbf",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-10-21"

{cmsdials-2.3.0 → cmsdials-2.4.0}/tests/integration/env.py

@@ -1,9 +1,10 @@
 import os
 
 
-CLIENT_SECRET = os.getenv("CLIENT_SECRET")
-if not CLIENT_SECRET:
+_client_secret = os.getenv("CLIENT_SECRET")
+if not _client_secret:
     raise OSError("CLIENT_SECRET environment variable is not set.")
+CLIENT_SECRET: str = _client_secret
 
 BASE_URL = os.getenv("BASE_URL", "https://dev-cmsdials-api.web.cern.ch/")
 # Client id of the application owning CLIENT_SECRET. When set, tests authenticate

{cmsdials-2.3.0 → cmsdials-2.4.0}/tests/integration/test_auth_client.py

@@ -5,7 +5,10 @@ import pytest
 from requests.exceptions import HTTPError
 
 from cmsdials import Dials
-from cmsdials.auth.bearer import Credentials as BearerCredentials
+from cmsdials.auth.client_credentials import (
+    Credentials as ClientCredentials,
+)
+from cmsdials.auth.device import Credentials as DeviceCredentials
 from cmsdials.auth.models import Token
 from cmsdials.auth.secret_key import Credentials as SecretKeyCredentials
 
@@ -14,7 +17,7 @@ from .utils import build_auth_client
 
 
 def __setup_dials_from_creds_and_test(
-    creds: Union[SecretKeyCredentials, BearerCredentials],
+    creds: Union[ClientCredentials, SecretKeyCredentials, DeviceCredentials],
 ) -> None:
     dials = Dials(creds, workspace=TEST_WORKSPACE, base_url=BASE_URL)
     # just test if we can access the workspace endpoints
@@ -29,8 +32,11 @@ def test_secret_key_success() -> None:
 
 @pytest.mark.skipif(CLIENT_ID is None, reason="CLIENT_ID is not set")
 def test_api_access_success() -> None:
-    creds = SecretKeyCredentials(
-        token=CLIENT_SECRET, client_id=CLIENT_ID, client=build_auth_client()
+    assert CLIENT_ID is not None
+    creds = ClientCredentials(
+        client_id=CLIENT_ID,
+        client_secret=CLIENT_SECRET,
+        client=build_auth_client(),
     )
     headers: dict[str, str] = {}
     creds.before_request(headers)
@@ -40,9 +46,12 @@ def test_api_access_success() -> None:
 
 @pytest.mark.skipif(CLIENT_ID is None, reason="CLIENT_ID is not set")
 def test_api_access_fail() -> None:
+    assert CLIENT_ID is not None
     with pytest.raises(HTTPError, match=r"401 Client Error: Unauthorized"):
-        SecretKeyCredentials(
-            token="123456789", client_id=CLIENT_ID, client=build_auth_client()
+        ClientCredentials(
+            client_id=CLIENT_ID,
+            client_secret="123456789",
+            client=build_auth_client(),
         )
 
 
@@ -57,14 +66,14 @@ def test_secret_key_fail() -> None:
 # This cannot be tested automatically since the `device_auth_flow` prints to stdout the url
 # the user needs to access in order to authenticate and pytest only enable "live log call"
 # if you specify the parameter "--log-cli-level=INFO".
-# def test_bearer_success() -> None:
+# def test_device_success() -> None:
 #     auth = build_auth_client()
 #     token = auth.device_auth_flow()
-#     creds = BearerCredentials.from_authclient_token(token, client=auth)
+#     creds = DeviceCredentials.from_authclient_token(token, client=auth)
 #     __setup_dials_from_creds_and_test(creds)
 
 
-def test_bearer_fail() -> None:
+def test_device_fail() -> None:
     token = Token(
         access_token="123456789",
         expires_in=600,
@@ -75,7 +84,7 @@ def test_bearer_fail() -> None:
         refresh_expires_at=datetime.now() + timedelta(seconds=12000),
     )
     auth = build_auth_client()
-    creds = BearerCredentials.from_authclient_token(token, client=auth)
+    creds = DeviceCredentials.from_authclient_token(token, client=auth)
     with pytest.raises(
         HTTPError, match=r"403 Client Error: Forbidden for url"
     ):

cmsdials-2.4.0/tests/integration/utils.py

@@ -0,0 +1,32 @@
+from cmsdials import Dials
+from cmsdials.auth._base import BaseCredentials
+from cmsdials.auth.client import AuthClient
+from cmsdials.auth.client_credentials import Credentials
+from cmsdials.auth.secret_key import Credentials as SecretKeyCredentials
+
+from .env import (
+    AUTH_AUDIENCE,
+    AUTH_CLIENT_ID,
+    BASE_URL,
+    CLIENT_ID,
+    CLIENT_SECRET,
+    TEST_WORKSPACE,
+)
+
+
+def build_auth_client() -> AuthClient:
+    return AuthClient(client_id=AUTH_CLIENT_ID, audience=AUTH_AUDIENCE)
+
+
+def setup_dials_object() -> Dials:
+    creds: BaseCredentials
+    if CLIENT_ID is None:
+        # Deprecated X-CLIENT-SECRET header, until DIALS stops accepting it
+        creds = SecretKeyCredentials(token=CLIENT_SECRET)
+    else:
+        creds = Credentials(
+            client_id=CLIENT_ID,
+            client_secret=CLIENT_SECRET,
+            client=build_auth_client(),
+        )
+    return Dials(creds, base_url=BASE_URL, workspace=TEST_WORKSPACE)

{cmsdials-2.3.0 → cmsdials-2.4.0}/tests/unit/test_auth.py

@@ -7,6 +7,10 @@ from requests.exceptions import HTTPError
 from cmsdials.auth import client as client_module
 from cmsdials.auth.bearer import Credentials as BearerCredentials
 from cmsdials.auth.client import AuthClient
+from cmsdials.auth.client_credentials import (
+    Credentials as ClientCredentials,
+)
+from cmsdials.auth.device import Credentials as DeviceCredentials
 from cmsdials.auth.exceptions import PendingAuthorizationError
 from cmsdials.auth.models import ApiToken, Token
 from cmsdials.auth.secret_key import Credentials as SecretKeyCredentials
@@ -70,6 +74,21 @@ def test_defaults_target_production():
     assert auth.audience == "cms-dials-prod-confidential-app"
 
 
+@pytest.mark.parametrize(
+    ("args", "kwargs"),
+    [
+        (("https://dev-cmsdials-api.web.cern.ch/",), {}),
+        ((), {"base_url": "https://dev-cmsdials-api.web.cern.ch/"}),
+        ((), {"route": "api/"}),
+        ((), {"version": "v1/"}),
+    ],
+)
+def test_auth_client_warns_on_ignored_api_arguments(args, kwargs):
+    with pytest.warns(DeprecationWarning, match="client_id and audience"):
+        auth = AuthClient(*args, **kwargs)
+    assert auth.audience == AuthClient.PRODUCTION_AUDIENCE
+
+
 def test_api_access_token_requests_dials_audience(keycloak):
     calls, responses = keycloak
     responses.append(FakeResponse(200, API_TOKEN))
@@ -137,7 +156,7 @@ def test_refresh_token_refreshes_then_exchanges(keycloak):
 
 
 def test_secret_key_without_client_id_is_deprecated():
-    with pytest.warns(DeprecationWarning):
+    with pytest.warns(DeprecationWarning, match="X-CLIENT-SECRET"):
         creds = SecretKeyCredentials(token="my-secret")
     headers = {}
     creds.before_request(headers)
@@ -159,10 +178,21 @@ class FakeAuthClient:
         )
 
 
-def test_secret_key_with_client_id_sends_bearer():
+def test_client_credentials_require_client_id_and_secret():
+    with pytest.raises(ValueError, match="client_id"):
+        ClientCredentials(
+            client_id="", client_secret="my-secret", client=FakeAuthClient()
+        )
+    with pytest.raises(ValueError, match="client_secret"):
+        ClientCredentials(
+            client_id="my-app", client_secret="", client=FakeAuthClient()
+        )
+
+
+def test_client_credentials_send_bearer():
     auth = FakeAuthClient()
-    creds = SecretKeyCredentials(
-        token="my-secret", client_id="my-app", client=auth
+    creds = ClientCredentials(
+        client_id="my-app", client_secret="my-secret", client=auth
     )
 
     headers = {}
@@ -174,10 +204,10 @@ def test_secret_key_with_client_id_sends_bearer():
     assert auth.issued == 1
 
 
-def test_secret_key_reissues_expired_token():
+def test_client_credentials_reissue_expired_token():
     auth = FakeAuthClient()
-    creds = SecretKeyCredentials(
-        token="my-secret", client_id="my-app", client=auth
+    creds = ClientCredentials(
+        client_id="my-app", client_secret="my-secret", client=auth
     )
     creds.expires_at = datetime.now() - timedelta(seconds=1)
 
@@ -188,6 +218,21 @@ def test_secret_key_reissues_expired_token():
     assert auth.issued == 2
 
 
+def test_secret_key_with_client_id_is_deprecated_alias():
+    auth = FakeAuthClient()
+    with pytest.warns(DeprecationWarning, match="client_credentials"):
+        creds = SecretKeyCredentials(
+            token="my-secret", client_id="my-app", client=auth
+        )
+
+    headers = {}
+    creds.before_request(headers)
+
+    assert isinstance(creds, ClientCredentials)
+    assert creds.client_secret == "my-secret"
+    assert headers == {"Authorization": "Bearer api-access-1"}
+
+
 class RejectingAuthClient:
     def __init__(self):
         self.device_flows = 0
@@ -209,10 +254,10 @@ class RejectingAuthClient:
         )
 
 
-def test_bearer_falls_back_to_device_flow_when_refresh_rejected(tmp_path):
+def test_device_falls_back_to_device_flow_when_refresh_rejected(tmp_path):
     now = datetime.now()
     auth = RejectingAuthClient()
-    creds = BearerCredentials(
+    creds = DeviceCredentials(
         token="old-access",
         expires_at=now - timedelta(seconds=1),
         expires_in=1200,
@@ -245,13 +290,13 @@ class UnreachableAuthClient(RejectingAuthClient):
         (UnreachableAuthClient, requests.exceptions.ConnectionError),
     ],
 )
-def test_bearer_does_not_hide_other_refresh_errors(
+def test_device_does_not_hide_other_refresh_errors(
     tmp_path, auth_class, error
 ):
     now = datetime.now()
     auth = auth_class()
     with pytest.raises(error):
-        BearerCredentials(
+        DeviceCredentials(
             token="old-access",
             expires_at=now - timedelta(seconds=1),
             expires_in=1200,
@@ -263,3 +308,48 @@ def test_bearer_does_not_hide_other_refresh_errors(
             client=auth,
         )
     assert auth.device_flows == 0
+
+
+def fresh_token():
+    now = datetime.now()
+    return Token(
+        access_token="dials-access",
+        expires_in=1200,
+        refresh_expires_in=36000,
+        refresh_token="public-refresh",
+        token_type="Bearer",
+        expires_at=now + timedelta(seconds=1200),
+        refresh_expires_at=now + timedelta(seconds=36000),
+    )
+
+
+def test_bearer_is_deprecated_alias(tmp_path):
+    token = fresh_token()
+    with pytest.warns(DeprecationWarning, match="auth.device"):
+        creds = BearerCredentials(
+            token=token.access_token,
+            expires_at=token.expires_at,
+            expires_in=token.expires_in,
+            refresh_expires_at=token.refresh_expires_at,
+            refresh_expires_in=token.refresh_expires_in,
+            refresh_token=token.refresh_token,
+            token_type=token.token_type,
+            cache_dir=str(tmp_path),
+            client=RejectingAuthClient(),
+        )
+    assert isinstance(creds, DeviceCredentials)
+
+    with pytest.warns(DeprecationWarning, match="auth.device"):
+        creds = BearerCredentials.from_authclient_token(
+            token, cache_dir=str(tmp_path), client=RejectingAuthClient()
+        )
+    assert isinstance(creds, DeviceCredentials)
+
+    # Reads the credentials cached by the calls above
+    with pytest.warns(DeprecationWarning, match="auth.device"):
+        creds = BearerCredentials.from_creds_file(
+            cache_dir=str(tmp_path), client=RejectingAuthClient()
+        )
+    headers = {}
+    creds.before_request(headers)
+    assert headers == {"Authorization": "Bearer dials-access"}

cmsdials-2.3.0/cmsdials/auth/secret_key.py

@@ -1,65 +0,0 @@
-import warnings
-from typing import Optional
-
-from ._base import BaseCredentials
-from .client import AuthClient
-
-
-class Credentials(BaseCredentials):
-    """
-    Client secret key credentials.
-    These credentials use an application's client id and secret to provide
-    authorization to automation scripts.
-
-    With `client_id`, an api-access token is issued by CERN's Keycloak and sent
-    as a Bearer token, and a new one is issued before it expires. The
-    application must have been granted API access in DIALS.
-
-    Without `client_id`, the secret is sent in the X-CLIENT-SECRET header.
-    This is deprecated and will stop working once DIALS removes the header.
-    """
-
-    def __init__(
-        self,
-        token: Optional[str],
-        client_id: Optional[str] = None,
-        client: Optional[AuthClient] = None,
-    ) -> None:
-        if not token:
-            raise ValueError(
-                "token must be a non-empty Client secret key string"
-            )
-        super().__init__()
-        self.client_id = client_id
-        self.client_secret = token
-
-        if client_id is None:
-            warnings.warn(
-                "Credentials without client_id authenticate with the "
-                "X-CLIENT-SECRET header, which DIALS will stop accepting. "
-                "Pass the application's client_id as well.",
-                DeprecationWarning,
-                stacklevel=2,
-            )
-            self.token = token
-            return
-
-        self.client = client or AuthClient()
-        self.refresh()
-
-    def refresh(self) -> None:
-        if self.client_id is None:
-            return
-        api_token = self.client.api_access_token(
-            self.client_id, self.client_secret
-        )
-        self.token = api_token.access_token
-        self.token_type = api_token.token_type
-        self.expires_in = api_token.expires_in
-        self.expires_at = api_token.expires_at
-
-    def apply(self, headers: dict[str, str]) -> None:
-        if self.client_id is None:
-            headers["X-CLIENT-SECRET"] = self.token
-        else:
-            headers["Authorization"] = f"{self.token_type} {self.token}"

cmsdials-2.3.0/tests/integration/utils.py

@@ -1,23 +0,0 @@
-from cmsdials import Dials
-from cmsdials.auth.client import AuthClient
-from cmsdials.auth.secret_key import Credentials
-
-from .env import (
-    AUTH_AUDIENCE,
-    AUTH_CLIENT_ID,
-    BASE_URL,
-    CLIENT_ID,
-    CLIENT_SECRET,
-    TEST_WORKSPACE,
-)
-
-
-def build_auth_client() -> AuthClient:
-    return AuthClient(client_id=AUTH_CLIENT_ID, audience=AUTH_AUDIENCE)
-
-
-def setup_dials_object() -> Dials:
-    creds = Credentials(
-        token=CLIENT_SECRET, client_id=CLIENT_ID, client=build_auth_client()
-    )
-    return Dials(creds, base_url=BASE_URL, workspace=TEST_WORKSPACE)