cmsdials 2.3.0__tar.gz → 2.4.1__tar.gz

{cmsdials-2.3.0 → cmsdials-2.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cmsdials
-Version: 2.3.0
+Version: 2.4.1
 Summary: The Python api client interface to DIALS service
 Author-email: Gabriel Moreira <gabriel.moreira@cern.ch>
 Project-URL: Repository, https://gitlab.cern.ch/cms-dqmdc/libraries/dials-py
@@ -53,21 +53,21 @@ Credentials are issued by CERN's Keycloak directly, dials-py never sends your pa
 ### Generating credentials with client secret
 
 ```python
-from cmsdials.auth.secret_key import Credentials
+from cmsdials.auth.client_credentials import Credentials
 
-creds = Credentials(client_id="my-application", token=".....")
+creds = Credentials(client_id="my-application", client_secret=".....")
 ```
 
 The token is renewed automatically before it expires.
 
-To get API access:
+To get API access (see [API access for applications](https://cms-ppd.docs.cern.ch/ts/software/DIALS/operations/api_access.html) for the details):
 
 1. Register an application in the [CERN Application Portal](https://application-portal.web.cern.ch) and enable "My application will need to get tokens using its own client ID and secret".
 2. Ask the DIALS team to grant API access to the application (it is added to the DIALS API access group).
 3. Use the application's client id and secret as shown above.
 
 > [!WARNING]
-> `Credentials(token=".....")` without `client_id` authenticates with the `X-CLIENT-SECRET` header, which is deprecated and emits a `DeprecationWarning`. DIALS will stop accepting it, so pass the `client_id` of your application.
+> `cmsdials.auth.secret_key.Credentials` is deprecated and emits a `DeprecationWarning`: it will be removed in dials-py 3.0.0. Replace `Credentials(client_id=..., token=...)` with `client_credentials.Credentials(client_id=..., client_secret=...)`. Without `client_id`, it authenticates with the `X-CLIENT-SECRET` header, which DIALS will stop accepting.
 
 ### Generating credentials with device
 
@@ -75,7 +75,7 @@ To get API access:
 
 ```python
 from cmsdials.auth.client import AuthClient
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 
 auth = AuthClient()
 token = auth.device_auth_flow()
@@ -87,15 +87,18 @@ creds = Credentials.from_authclient_token(token)
 Credentials are always cached once you authenticate at least one time, calling this method without having a cached credential file will automatically trigger the AuthClient device flow.
 
 ```python
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 
 creds = Credentials.from_creds_file()
 ```
 
+> [!WARNING]
+> `cmsdials.auth.bearer.Credentials` is deprecated and emits a `DeprecationWarning`: it will be removed in dials-py 3.0.0. Import `Credentials` from `cmsdials.auth.device` instead, it takes the same arguments.
+
 ### Basic Example
 
 ```python
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 from cmsdials import Dials
 from cmsdials.filters import LumisectionHistogram1DFilters
 
@@ -129,8 +132,8 @@ dials.lumi.get(dataset_id=14677060, run_number=367112, ls_number=10)
 dials.run.get(dataset_id=14677060, run_number=367112)
 
 # jetmet worskpace
-dials.ml_models_index(model_id=1)
-dials.ml_bad_lumisection(model_id=19, dataset_id=15102369, run_number=386951, ls_number=36)
+dials.ml_models_index.get(model_id=1)
+dials.ml_bad_lumis.get(model_id=19, dataset_id=15102369, run_number=386951, ls_number=36)
 ```
 
 ### Retrieving a list of objects per page using `list`
@@ -145,7 +148,7 @@ dials.h2d.list()
 dials.lumi.list()
 dials.run.list()
 dials.ml_models_index.list()
-dials.ml_bad_lumisection.list()
+dials.ml_bad_lumis.list()
 ```
 
 ### Retrieving all available pages of a list of objects using `list_all`
@@ -161,7 +164,7 @@ dials.h2d.list_all()
 dials.lumi.list_all()
 dials.run.list_all()
 dials.ml_models_index.list_all()
-dials.ml_bad_lumisection.list_all()
+dials.ml_bad_lumis.list_all()
 ```
 
 If you don't need all available pages but just a subset of then, it is possible to specify a `max_pages` integer parameter:
@@ -260,7 +263,7 @@ When listing and endpoint for a long time, you may loose connection or the serve
 
 ```python
 from cmsdials.auth.client import AuthClient
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 from cmsdials import Dials
 from cmsdials.filters import LumisectionHistogram2DFilters
 
@@ -319,7 +322,7 @@ The `AuthClient` issues tokens for the production DIALS applications by default.
 
 ```python
 from cmsdials.auth.client import AuthClient
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 from cmsdials import Dials
 from cmsdials.filters import LumisectionHistogram2DFilters
 
@@ -338,9 +341,9 @@ dials.h2d.list_all(LumisectionHistogram2DFilters(me__regex="EEOT digi occupancy
 When authenticating with a client secret, pass the same `AuthClient` so the token is issued for that instance:
 
 ```python
-from cmsdials.auth.secret_key import Credentials as SecretKeyCredentials
+from cmsdials.auth.client_credentials import Credentials as ClientCredentials
 
-creds = SecretKeyCredentials(client_id="my-application", token=".....", client=auth)
+creds = ClientCredentials(client_id="my-application", client_secret=".....", client=auth)
 dials = Dials(creds, base_url=DIALS_URL)
 ```
 

{cmsdials-2.3.0 → cmsdials-2.4.1}/README.md

@@ -30,21 +30,21 @@ Credentials are issued by CERN's Keycloak directly, dials-py never sends your pa
 ### Generating credentials with client secret
 
 ```python
-from cmsdials.auth.secret_key import Credentials
+from cmsdials.auth.client_credentials import Credentials
 
-creds = Credentials(client_id="my-application", token=".....")
+creds = Credentials(client_id="my-application", client_secret=".....")
 ```
 
 The token is renewed automatically before it expires.
 
-To get API access:
+To get API access (see [API access for applications](https://cms-ppd.docs.cern.ch/ts/software/DIALS/operations/api_access.html) for the details):
 
 1. Register an application in the [CERN Application Portal](https://application-portal.web.cern.ch) and enable "My application will need to get tokens using its own client ID and secret".
 2. Ask the DIALS team to grant API access to the application (it is added to the DIALS API access group).
 3. Use the application's client id and secret as shown above.
 
 > [!WARNING]
-> `Credentials(token=".....")` without `client_id` authenticates with the `X-CLIENT-SECRET` header, which is deprecated and emits a `DeprecationWarning`. DIALS will stop accepting it, so pass the `client_id` of your application.
+> `cmsdials.auth.secret_key.Credentials` is deprecated and emits a `DeprecationWarning`: it will be removed in dials-py 3.0.0. Replace `Credentials(client_id=..., token=...)` with `client_credentials.Credentials(client_id=..., client_secret=...)`. Without `client_id`, it authenticates with the `X-CLIENT-SECRET` header, which DIALS will stop accepting.
 
 ### Generating credentials with device
 
@@ -52,7 +52,7 @@ To get API access:
 
 ```python
 from cmsdials.auth.client import AuthClient
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 
 auth = AuthClient()
 token = auth.device_auth_flow()
@@ -64,15 +64,18 @@ creds = Credentials.from_authclient_token(token)
 Credentials are always cached once you authenticate at least one time, calling this method without having a cached credential file will automatically trigger the AuthClient device flow.
 
 ```python
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 
 creds = Credentials.from_creds_file()
 ```
 
+> [!WARNING]
+> `cmsdials.auth.bearer.Credentials` is deprecated and emits a `DeprecationWarning`: it will be removed in dials-py 3.0.0. Import `Credentials` from `cmsdials.auth.device` instead, it takes the same arguments.
+
 ### Basic Example
 
 ```python
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 from cmsdials import Dials
 from cmsdials.filters import LumisectionHistogram1DFilters
 
@@ -106,8 +109,8 @@ dials.lumi.get(dataset_id=14677060, run_number=367112, ls_number=10)
 dials.run.get(dataset_id=14677060, run_number=367112)
 
 # jetmet worskpace
-dials.ml_models_index(model_id=1)
-dials.ml_bad_lumisection(model_id=19, dataset_id=15102369, run_number=386951, ls_number=36)
+dials.ml_models_index.get(model_id=1)
+dials.ml_bad_lumis.get(model_id=19, dataset_id=15102369, run_number=386951, ls_number=36)
 ```
 
 ### Retrieving a list of objects per page using `list`
@@ -122,7 +125,7 @@ dials.h2d.list()
 dials.lumi.list()
 dials.run.list()
 dials.ml_models_index.list()
-dials.ml_bad_lumisection.list()
+dials.ml_bad_lumis.list()
 ```
 
 ### Retrieving all available pages of a list of objects using `list_all`
@@ -138,7 +141,7 @@ dials.h2d.list_all()
 dials.lumi.list_all()
 dials.run.list_all()
 dials.ml_models_index.list_all()
-dials.ml_bad_lumisection.list_all()
+dials.ml_bad_lumis.list_all()
 ```
 
 If you don't need all available pages but just a subset of then, it is possible to specify a `max_pages` integer parameter:
@@ -237,7 +240,7 @@ When listing and endpoint for a long time, you may loose connection or the serve
 
 ```python
 from cmsdials.auth.client import AuthClient
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 from cmsdials import Dials
 from cmsdials.filters import LumisectionHistogram2DFilters
 
@@ -296,7 +299,7 @@ The `AuthClient` issues tokens for the production DIALS applications by default.
 
 ```python
 from cmsdials.auth.client import AuthClient
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 from cmsdials import Dials
 from cmsdials.filters import LumisectionHistogram2DFilters
 
@@ -315,9 +318,9 @@ dials.h2d.list_all(LumisectionHistogram2DFilters(me__regex="EEOT digi occupancy
 When authenticating with a client secret, pass the same `AuthClient` so the token is issued for that instance:
 
 ```python
-from cmsdials.auth.secret_key import Credentials as SecretKeyCredentials
+from cmsdials.auth.client_credentials import Credentials as ClientCredentials
 
-creds = SecretKeyCredentials(client_id="my-application", token=".....", client=auth)
+creds = ClientCredentials(client_id="my-application", client_secret=".....", client=auth)
 dials = Dials(creds, base_url=DIALS_URL)
 ```
 

{cmsdials-2.3.0 → cmsdials-2.4.1}/cmsdials/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '2.3.0'
-__version_tuple__ = version_tuple = (2, 3, 0)
+__version__ = version = '2.4.1'
+__version_tuple__ = version_tuple = (2, 4, 1)
 
-__commit_id__ = commit_id = 'g044d28ceb'
+__commit_id__ = commit_id = 'g7433d876a'

cmsdials-2.4.1/cmsdials/auth/bearer.py

@@ -0,0 +1,62 @@
+import warnings
+from datetime import datetime
+from typing import Optional
+
+from .client import AuthClient
+from .device import Credentials as DeviceCredentials
+from .models import Token
+
+
+_DEPRECATION = (
+    "cmsdials.auth.bearer.Credentials is deprecated and will be removed in "
+    "dials-py 3.0.0, use cmsdials.auth.device.Credentials instead."
+)
+
+
+class Credentials(DeviceCredentials):
+    """
+    Deprecated, use `cmsdials.auth.device.Credentials`.
+    """
+
+    def __init__(
+        self,
+        token: str,
+        expires_at: datetime,
+        expires_in: int,
+        refresh_expires_at: datetime,
+        refresh_expires_in: int,
+        refresh_token: str,
+        token_type: str,
+        cache_dir: Optional[str] = None,
+        client: Optional[AuthClient] = None,
+    ):
+        warnings.warn(_DEPRECATION, DeprecationWarning, stacklevel=2)
+        super().__init__(
+            token=token,
+            expires_at=expires_at,
+            expires_in=expires_in,
+            refresh_expires_at=refresh_expires_at,
+            refresh_expires_in=refresh_expires_in,
+            refresh_token=refresh_token,
+            token_type=token_type,
+            cache_dir=cache_dir,
+            client=client,
+        )
+
+    @staticmethod
+    def from_authclient_token(
+        token: Token,
+        cache_dir: Optional[str] = None,
+        client: Optional[AuthClient] = None,
+    ) -> DeviceCredentials:
+        warnings.warn(_DEPRECATION, DeprecationWarning, stacklevel=2)
+        return DeviceCredentials.from_authclient_token(
+            token, cache_dir, client
+        )
+
+    @staticmethod
+    def from_creds_file(
+        cache_dir: Optional[str] = None, client: Optional[AuthClient] = None
+    ) -> DeviceCredentials:
+        warnings.warn(_DEPRECATION, DeprecationWarning, stacklevel=2)
+        return DeviceCredentials.from_creds_file(cache_dir, client)

{cmsdials-2.3.0 → cmsdials-2.4.1}/cmsdials/auth/client.py

@@ -1,4 +1,5 @@
 import time
+import warnings
 from datetime import datetime, timedelta
 from typing import Optional
 
@@ -47,6 +48,23 @@ class AuthClient(BaseAPIClient):
         audience: Optional[str] = None,
         **kwargs,
     ) -> None:
+        # Leftovers from releases that logged in through DIALS: tokens are now
+        # issued by Keycloak, and the instance is selected by client_id and
+        # audience, so these would silently target production.
+        ignored = [
+            name
+            for name in ("base_url", "route", "version")
+            if kwargs.get(name) is not None
+        ]
+        if args or ignored:
+            warnings.warn(
+                "AuthClient ignores base_url, route and version, which will "
+                "raise TypeError in dials-py 3.0.0. Tokens are issued by CERN "
+                "Keycloak: to target another DIALS instance, pass its "
+                "client_id and audience instead.",
+                DeprecationWarning,
+                stacklevel=2,
+            )
         super().__init__(*args, **kwargs)
         keycloak_url = keycloak_url or self.PRODUCTION_KEYCLOAK_URL
         if not keycloak_url.endswith("/"):

cmsdials-2.4.1/cmsdials/auth/client_credentials.py

@@ -0,0 +1,48 @@
+from typing import Optional
+
+from ._base import BaseCredentials
+from .client import AuthClient
+
+
+class Credentials(BaseCredentials):
+    """
+    Client credentials.
+    These credentials use an application's client id and secret to provide
+    authorization to automation scripts.
+
+    An api-access token is issued by CERN's Keycloak and sent as a Bearer
+    token, and a new one is issued before it expires. The application must
+    have been granted API access in DIALS.
+    """
+
+    def __init__(
+        self,
+        client_id: str,
+        client_secret: str,
+        client: Optional[AuthClient] = None,
+    ) -> None:
+        if not client_id:
+            raise ValueError(
+                "client_id must be the non-empty client id of the application"
+            )
+        if not client_secret:
+            raise ValueError(
+                "client_secret must be the non-empty client secret of the application"
+            )
+        super().__init__()
+        self.client_id = client_id
+        self.client_secret = client_secret
+        self.client = client or AuthClient()
+        self.refresh()
+
+    def refresh(self) -> None:
+        api_token = self.client.api_access_token(
+            self.client_id, self.client_secret
+        )
+        self.token = api_token.access_token
+        self.token_type = api_token.token_type
+        self.expires_in = api_token.expires_in
+        self.expires_at = api_token.expires_at
+
+    def apply(self, headers: dict[str, str]) -> None:
+        headers["Authorization"] = f"{self.token_type} {self.token}"

cmsdials-2.3.0/cmsdials/auth/bearer.py → cmsdials-2.4.1/cmsdials/auth/device.py

@@ -19,8 +19,11 @@ DEFAULT_CACHE_FILENAME = "creds"
 
 class Credentials(BaseCredentials):
     """
-    Token credentials.
-    These credential use a token to provide authorization to applications.
+    Device credentials.
+    These credentials authenticate a person with the device authorization
+    grant on CERN's Keycloak, and renew the token with its refresh token.
+    Tokens are cached in a file, and the device flow is triggered again
+    when they can no longer be renewed.
     """
 
     def __init__(
@@ -170,6 +173,6 @@ class Credentials(BaseCredentials):
 
     def apply(self, headers: dict[str, str]) -> None:
         """
-        Apply the Client secret key token to the X-CLIENT-SECRET header.
+        Apply the access token to the Authorization header.
         """
         headers["Authorization"] = f"{self.token_type} {self.token}"

cmsdials-2.4.1/cmsdials/auth/secret_key.py

@@ -0,0 +1,68 @@
+import warnings
+from typing import Optional
+
+from ._base import BaseCredentials
+from .client import AuthClient
+from .client_credentials import Credentials as ClientCredentials
+
+
+class Credentials(ClientCredentials):
+    """
+    Deprecated, use `cmsdials.auth.client_credentials.Credentials`.
+
+    With `client_id`, it behaves as client credentials, with `token` as the
+    client secret.
+
+    Without `client_id`, the secret is sent in the X-CLIENT-SECRET header.
+    This will stop working once DIALS removes the header.
+    """
+
+    def __init__(
+        self,
+        token: Optional[str],
+        client_id: Optional[str] = None,
+        client: Optional[AuthClient] = None,
+    ) -> None:
+        if not token:
+            raise ValueError(
+                "token must be a non-empty Client secret key string"
+            )
+
+        replacement = (
+            "use cmsdials.auth.client_credentials.Credentials("
+            "client_id=..., client_secret=...) instead."
+        )
+        self.legacy_header = client_id is None
+        if client_id is None:
+            warnings.warn(
+                "Credentials without client_id authenticate with the "
+                "X-CLIENT-SECRET header, which DIALS will stop accepting, "
+                + replacement,
+                DeprecationWarning,
+                stacklevel=2,
+            )
+            BaseCredentials.__init__(self)
+            self.client_secret = token
+            self.token = token
+            return
+
+        warnings.warn(
+            "cmsdials.auth.secret_key.Credentials is deprecated and will be "
+            "removed in dials-py 3.0.0, " + replacement,
+            DeprecationWarning,
+            stacklevel=2,
+        )
+        super().__init__(
+            client_id=client_id, client_secret=token, client=client
+        )
+
+    def refresh(self) -> None:
+        if self.legacy_header:
+            return
+        super().refresh()
+
+    def apply(self, headers: dict[str, str]) -> None:
+        if self.legacy_header:
+            headers["X-CLIENT-SECRET"] = self.token
+        else:
+            super().apply(headers)

{cmsdials-2.3.0 → cmsdials-2.4.1}/cmsdials/clients/ml_bad_lumisection/client.py

@@ -24,10 +24,9 @@ class MLBadLumisectionClient(
         dataset_id: int,
         run_number: int,
         ls_number: int,
-        me_id: int,
         **kwargs,
     ):
-        edp = f"{model_id}/{dataset_id}/{run_number}/{ls_number}/{me_id}/"
+        edp = f"{model_id}/{dataset_id}/{run_number}/{ls_number}/"
         return super()._get(edp, **kwargs)
 
     def __json_body_builder(

{cmsdials-2.3.0 → cmsdials-2.4.1}/cmsdials.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cmsdials
-Version: 2.3.0
+Version: 2.4.1
 Summary: The Python api client interface to DIALS service
 Author-email: Gabriel Moreira <gabriel.moreira@cern.ch>
 Project-URL: Repository, https://gitlab.cern.ch/cms-dqmdc/libraries/dials-py
@@ -53,21 +53,21 @@ Credentials are issued by CERN's Keycloak directly, dials-py never sends your pa
 ### Generating credentials with client secret
 
 ```python
-from cmsdials.auth.secret_key import Credentials
+from cmsdials.auth.client_credentials import Credentials
 
-creds = Credentials(client_id="my-application", token=".....")
+creds = Credentials(client_id="my-application", client_secret=".....")
 ```
 
 The token is renewed automatically before it expires.
 
-To get API access:
+To get API access (see [API access for applications](https://cms-ppd.docs.cern.ch/ts/software/DIALS/operations/api_access.html) for the details):
 
 1. Register an application in the [CERN Application Portal](https://application-portal.web.cern.ch) and enable "My application will need to get tokens using its own client ID and secret".
 2. Ask the DIALS team to grant API access to the application (it is added to the DIALS API access group).
 3. Use the application's client id and secret as shown above.
 
 > [!WARNING]
-> `Credentials(token=".....")` without `client_id` authenticates with the `X-CLIENT-SECRET` header, which is deprecated and emits a `DeprecationWarning`. DIALS will stop accepting it, so pass the `client_id` of your application.
+> `cmsdials.auth.secret_key.Credentials` is deprecated and emits a `DeprecationWarning`: it will be removed in dials-py 3.0.0. Replace `Credentials(client_id=..., token=...)` with `client_credentials.Credentials(client_id=..., client_secret=...)`. Without `client_id`, it authenticates with the `X-CLIENT-SECRET` header, which DIALS will stop accepting.
 
 ### Generating credentials with device
 
@@ -75,7 +75,7 @@ To get API access:
 
 ```python
 from cmsdials.auth.client import AuthClient
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 
 auth = AuthClient()
 token = auth.device_auth_flow()
@@ -87,15 +87,18 @@ creds = Credentials.from_authclient_token(token)
 Credentials are always cached once you authenticate at least one time, calling this method without having a cached credential file will automatically trigger the AuthClient device flow.
 
 ```python
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 
 creds = Credentials.from_creds_file()
 ```
 
+> [!WARNING]
+> `cmsdials.auth.bearer.Credentials` is deprecated and emits a `DeprecationWarning`: it will be removed in dials-py 3.0.0. Import `Credentials` from `cmsdials.auth.device` instead, it takes the same arguments.
+
 ### Basic Example
 
 ```python
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 from cmsdials import Dials
 from cmsdials.filters import LumisectionHistogram1DFilters
 
@@ -129,8 +132,8 @@ dials.lumi.get(dataset_id=14677060, run_number=367112, ls_number=10)
 dials.run.get(dataset_id=14677060, run_number=367112)
 
 # jetmet worskpace
-dials.ml_models_index(model_id=1)
-dials.ml_bad_lumisection(model_id=19, dataset_id=15102369, run_number=386951, ls_number=36)
+dials.ml_models_index.get(model_id=1)
+dials.ml_bad_lumis.get(model_id=19, dataset_id=15102369, run_number=386951, ls_number=36)
 ```
 
 ### Retrieving a list of objects per page using `list`
@@ -145,7 +148,7 @@ dials.h2d.list()
 dials.lumi.list()
 dials.run.list()
 dials.ml_models_index.list()
-dials.ml_bad_lumisection.list()
+dials.ml_bad_lumis.list()
 ```
 
 ### Retrieving all available pages of a list of objects using `list_all`
@@ -161,7 +164,7 @@ dials.h2d.list_all()
 dials.lumi.list_all()
 dials.run.list_all()
 dials.ml_models_index.list_all()
-dials.ml_bad_lumisection.list_all()
+dials.ml_bad_lumis.list_all()
 ```
 
 If you don't need all available pages but just a subset of then, it is possible to specify a `max_pages` integer parameter:
@@ -260,7 +263,7 @@ When listing and endpoint for a long time, you may loose connection or the serve
 
 ```python
 from cmsdials.auth.client import AuthClient
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 from cmsdials import Dials
 from cmsdials.filters import LumisectionHistogram2DFilters
 
@@ -319,7 +322,7 @@ The `AuthClient` issues tokens for the production DIALS applications by default.
 
 ```python
 from cmsdials.auth.client import AuthClient
-from cmsdials.auth.bearer import Credentials
+from cmsdials.auth.device import Credentials
 from cmsdials import Dials
 from cmsdials.filters import LumisectionHistogram2DFilters
 
@@ -338,9 +341,9 @@ dials.h2d.list_all(LumisectionHistogram2DFilters(me__regex="EEOT digi occupancy
 When authenticating with a client secret, pass the same `AuthClient` so the token is issued for that instance:
 
 ```python
-from cmsdials.auth.secret_key import Credentials as SecretKeyCredentials
+from cmsdials.auth.client_credentials import Credentials as ClientCredentials
 
-creds = SecretKeyCredentials(client_id="my-application", token=".....", client=auth)
+creds = ClientCredentials(client_id="my-application", client_secret=".....", client=auth)
 dials = Dials(creds, base_url=DIALS_URL)
 ```
 

{cmsdials-2.3.0 → cmsdials-2.4.1}/cmsdials.egg-info/SOURCES.txt

@@ -28,6 +28,8 @@ cmsdials/auth/__init__.py
 cmsdials/auth/_base.py
 cmsdials/auth/bearer.py
 cmsdials/auth/client.py
+cmsdials/auth/client_credentials.py
+cmsdials/auth/device.py
 cmsdials/auth/exceptions.py
 cmsdials/auth/models.py
 cmsdials/auth/secret_key.py

{cmsdials-2.3.0 → cmsdials-2.4.1}/cmsdials.egg-info/scm_file_list.json

@@ -14,6 +14,8 @@
     "cmsdials/auth/_base.py",
     "cmsdials/auth/bearer.py",
     "cmsdials/auth/client.py",
+    "cmsdials/auth/client_credentials.py",
+    "cmsdials/auth/device.py",
     "cmsdials/auth/exceptions.py",
     "cmsdials/auth/models.py",
     "cmsdials/auth/secret_key.py",

cmsdials-2.4.1/cmsdials.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "2.4.1",
+  "distance": 0,
+  "node": "g7433d876a15e84ba41f91fc496977fa330e97a8e",
+  "dirty": false,
+  "branch": "HEAD",
+  "node_date": "2026-10-22"
+}

{cmsdials-2.3.0 → cmsdials-2.4.1}/tests/integration/env.py

@@ -1,9 +1,10 @@
 import os
 
 
-CLIENT_SECRET = os.getenv("CLIENT_SECRET")
-if not CLIENT_SECRET:
+_client_secret = os.getenv("CLIENT_SECRET")
+if not _client_secret:
     raise OSError("CLIENT_SECRET environment variable is not set.")
+CLIENT_SECRET: str = _client_secret
 
 BASE_URL = os.getenv("BASE_URL", "https://dev-cmsdials-api.web.cern.ch/")
 # Client id of the application owning CLIENT_SECRET. When set, tests authenticate